CVE-2026-85738

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.4.0

Description The checkSsrf logic in server/src/utils/ssrfGuard.ts fails to recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user controlling a DNS record can provide a URL with a AAAA result that is a transition address embedding a private, loopback, or link-local IPv4 target. Because isAlwaysBlocked and isPrivateNetwork classify these addresses as allowed, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata, leading to information exposure. Server-Side Request Forgery (SSRF) is a flaw where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update to version 3.4.0.