CVE-2026-72761

Name of the Vulnerable Software and Affected Versions vulnerability-lookup (affected versions not specified)

Description The webhook URL validator in website/notifications/webhooks.py uses ip.is global to reject non-public addresses after DNS resolution. However, IPv6 transition addresses, such as NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001:0000::/32, are classified as globally routable by IANA. Consequently, is global returns True even if the embedded IPv4 targets a private, loopback, or cloud metadata destination. This allows an attacker to register a webhook pointing to a hostname that resolves to a transition address, bypassing the Server-Side Request Forgery (SSRF) guard to exfiltrate data to an internal endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.