CVE-2026-79659

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.7.3

Description An issue exists where the fetchPeerConnectInfo() function uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations. This leads to Server-Side Request Forgery (SSRF), a condition where a server is tricked into making requests to an unintended location.

Recommendations Update to version 4.7.3 or later. As a temporary workaround, restrict the use of the fetchPeerConnectInfo() function.