PT-2026-137162

CVE-2026-122140

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Trawl versions 1.5.0 through 1.9.9

Description A server-side request forgery (SSRF) issue allows unauthenticated attackers to bypass the MCP outbound URL policy. This is achieved by using IPv4-mapped IPv6 addresses, where attackers provide hex-normalized addresses such as ::ffff:7f00:1 directly or through redirects. This allows the unauthorized fetching of loopback, private, and cloud metadata services to read their responses.

Recommendations Update Trawl to version 1.10.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Komiljon Ayubov

Leardian

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)