CVE-2026-84697

Name of the Vulnerable Software and Affected Versions Mailpit (affected versions not specified)

Description The IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix. This allows server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location. Attackers can provide hostnames that resolve to these addresses within message content to access the link check API and proxy endpoint, enabling access to internal resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.