CVE-2026-55187

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.2

Description An incomplete Server-Side Request Forgery (SSRF) protection exists in the Link Check API. The tools.IsInternalIP deny-list in internal/tools/net.go fails to block certain IPv6 transition mechanisms and prefixes, including NAT64, 6to4, IPv4-compatible IPv6, ISATAP, fec0::/10, and 2001:db8::/32. An attacker can deliver an email and invoke the 'POST /api/v1/message/{ID}/link-check' endpoint to coerce the safeDialContext path into dialing internal destinations. By analyzing status codes and error feedback, the attacker can map internal service reachability, including cloud metadata endpoints.

Recommendations Update to version 1.30.2.