CVE-2026-105689

Executive Summary

CVE-2026-105689 is a Server-Side Request Forgery (SSRF) bypass in Penpot, an open-source design and prototyping platform, affecting versions prior to 2.18.0. The vulnerability resides in the app.util.ssrf/blocked-address? function, which relies on Java InetAddress predicates that fail to classify IPv6 transition addresses (NAT64, 6to4, and Teredo) and applies additional CIDR checks only to IPv4 values. An attacker who controls a media import URL or a webhook URL can embed a cloud-metadata, loopback, link-local, or private IPv4 target inside an IPv6 transition address, bypassing the intended SSRF restrictions and reaching internal network resources. Media import can disclose response bodies, while webhook delivery exposes response status as a network-probing side channel.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). Penpot includes an SSRF protection utility referenced in the advisory as app.util.ssrf/blocked-address?. This predicate is designed to reject requests to internal, loopback, link-local, and private address ranges. The advisory states that the implementation:

1. Relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses. These are IPv6 transition mechanisms that can embed an IPv4 address within an IPv6 address:

   • NAT64 — Uses a well-known prefix (commonly 64:ff9b::/96) to map IPv4 addresses into IPv6 space.
   • 6to4 — Embeds an IPv4 address in the IPv6 prefix (2002::/16).
   • Teredo — Encapsulates IPv4 in IPv6 (2001::/32).

2. Applies additional CIDR checks only to IPv4 values. When a value is presented as an IPv6 transition address, the IPv4-specific CIDR blocklist is not evaluated, allowing embedded private/loopback/link-local IPv4 targets to pass validation.

The result is that an IPv6 transition address presented to the blocked-address? predicate is not recognized as referencing a blocked IPv4 destination, and the request proceeds to be made by the Penpot backend. Exploitation requires either routing through a NAT64 gateway or an attacker-controlled DNS AAAA record. The advisory explicitly notes that cloud environments with NAT64 gateways are directly exploitable.

The attack surface comprises two user-controllable URL inputs:

• Media import URL — A user-level input. Successful abuse can disclose the response body of the fetched internal resource.
• Webhook URL — An administrator-level input. Webhook delivery exposes response status, providing a network-probing side channel.

No public proof-of-concept, Nuclei template, or exploit code is available per the provided data. The attack chain is therefore inferred from the vulnerability class and the advisory description.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the SSRF vulnerability class and the advisory text. Only identifiers explicitly named in the advisory (app.util.ssrf/blocked-address?, media import URL, webhook URL) are referenced.

1. Reconnaissance / target identification. The attacker identifies a reachable Penpot instance running a version prior to 2.18.0. The attacker requires either (a) a network path through a NAT64 gateway, or (b) the ability to control a DNS AAAA record that the Penpot backend will resolve. The advisory states that cloud deployments with a NAT64 gateway are directly exploitable.

2. Triggering the flaw class. The attacker supplies, via a user-controlled media import URL or an administrator-controlled webhook URL, a URL whose host is an IPv6 transition address (NAT64, 6to4, or Teredo) that embeds an IPv4 target — such as a cloud-metadata address, loopback, link-local, or private range address. Because app.util.ssrf/blocked-address? does not classify these transition addresses and applies its additional CIDR checks only to IPv4 literals, the embedded IPv4 target is not recognized as blocked and validation passes.

3. Payload / execution method (vulnerability-class level). The Penpot backend then issues the outbound HTTP request to the address encoded in the transition IPv6 literal. The request is made from the server's network context, reaching internal-only resources that the attacker cannot reach directly. No specific parameter names, endpoints beyond the named function, or code patterns are disclosed in the advisory; the mechanism is the standard SSRF bypass via IPv6 transition-address encoding.

4. Post-exploitation impact. Two distinct outcomes are described:

   • Media import — The response body of the fetched internal resource can be disclosed to the attacker, enabling exfiltration of content from internal services (for example, cloud instance metadata, whose specific endpoints are not named in the advisory).
   • Webhook delivery — The response status is observable, yielding a network-probing side channel that allows the attacker to map reachable internal hosts and ports based on success/failure responses.

The advisory does not state that remote code execution or credential theft is directly achievable; impact is limited to information disclosure and internal network reconnaissance as described.

Impact Assessment

• Confidentiality: High (C:H) — Media import can disclose response bodies from internal resources.
• Integrity: None (I:N) — The advisory describes no write or modification primitive.
• Availability: None (A:N) — No denial-of-service primitive is described.
• Scope: Changed (S:C) — The vulnerable component (SSRF validation) is bypassed, and the resulting request affects resources beyond Penpot's intended security scope (internal network).
• Attack Vector: Network (AV:N) — Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — Given the required network condition (NAT64 gateway or attacker-controlled AAAA record).
• Privileges Required: Low (PR:L) — A user controlling a media import URL, or an admin controlling a webhook URL.
• User Interaction: None (UI:N) — No victim interaction described.

Affected systems: self-hosted and cloud Penpot deployments prior to 2.18.0. Cloud environments with NAT64 gateways have the largest blast radius because they are described as directly exploitable. The side-channel capability from webhook delivery increases internal-network reconnaissance value even without direct body disclosure.

Detection Guidance

Sigma Rule

title: Penpot SSRF via IPv6 Transition Address (CVE-2026-105689)
id: 8f3b2c1a-9d4e-4a7b-b6c2-105689penpot
status: experimental
description: Detects outbound requests from Penpot that reference NAT64/6to4/Teredo IPv6 transition literals potentially embedding internal IPv4 targets.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105689
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: linux
detection:
  selection_transition:
    DestinationIp|cidr:
      - '64:ff9b::/96'
      - '2002::/16'
      - '2001::/32'
  selection_process:
    Image|endswith:
      - 'java'
  condition: selection_transition and selection_process
falsepositives:
  - Legitimate NAT64 egress in dual-stack environments
level: medium
tags:
  - attack.t1190
  - cve.2026.105689

YARA Rule

rule CVE_2026_105689_Penpot_SSRF_IPv6_Transition
{
    meta:
        description = "Detects references to IPv6 transition address handling related to Penpot SSRF CVE-2026-105689"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105689"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ssrf_fn = "blocked-address?" ascii nocase
        $nat64   = "64:ff9b::"        ascii nocase
        $sixto4  = "2002:"            ascii nocase
        $teredo  = "2001:0:"          ascii nocase
        $ssrfmod = "app.util.ssrf"    ascii nocase

    condition:
        $ssrf_fn and $ssrfmod and any of ($nat64, $sixto4, $teredo)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105689 Penpot SSRF via IPv6 Transition Address"; flow:to_server,established; http.uri; content:"url"; nocase; pcre:"/(https?:\/\/\[?)(64:ff9b::|2002:|2001:0:)/i"; reference:cve,2026-105689; classtype:attempted-recon; sid:2026105689; rev:1;)

Elastic Detection

network where
  destination.ip in ("64:ff9b::/96", "2002::/16", "2001::/32") and
  process.name == "java" and
  network.direction == "egress"

Splunk SPL Query

index=* (sourcetype=*proxy* OR sourcetype=*firewall* OR sourcetype=*pan:*)
| eval dest_lower=lower(dest)
| where match(dest_lower,"^(64:ff9b::|2002:|2001:0:)")
| table _time, src, dest, url, user, action
| sort - _time

Wazuh OSSEC Rule

<group name="penpot,ssrf,cve-2026-105689,">
  <rule id="105689" level="10">
    <decoded_as>json</decoded_as>
    <field name="destination_ip">64:ff9b::|2002:|2001:0:</field>
    <description>CVE-2026-105689: Possible Penpot SSRF via IPv6 transition address to internal IPv4</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105689,ssrf_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Upgrade to Penpot 2.18.0 or later where possible. The advisory states the issue is fixed in 2.18.0.
   • Where upgrade is not immediately possible, restrict backend egress so that outbound connections from the Penpot server cannot reach NAT64 prefixes (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32), and block egress to cloud metadata endpoints and private/loopback/link-local ranges at the network layer.
   • Remove or disable NAT64 gateways that route Penpot backend traffic into internal IPv4 space where not strictly required.
   • Constrain media import and webhook URL configuration to trusted administrators and, where feasible, disable user-supplied media import URLs.
   • Monitor webhook and media import URL inputs for IPv6 transition literals.

2. Patch / upgrade steps.

   • Update Penpot to 2.18.0 or later. No vendor advisory URL was supplied in the given data; consult the official Penpot release notes for 2.18.0. Verify the deployed version post-upgrade.

3. Long-term hardening.

   • Replace reliance on Java InetAddress predicates with a validation routine that resolves and classifies all resulting addresses, including IPv6 transition forms (NAT64, 6to4, Teredo), before any outbound request.
   • Enforce an allowlist of permitted media import and webhook destinations rather than a denylist.
   • Apply defense-in-depth network segmentation and egress filtering so that SSRF bypasses cannot reach metadata or internal services.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105689
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Penpot project release notes for version 2.18.0 (official release channel)
• CISA KEV Catalog: NOT listed (verified no known-exploited status for this CVE)

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-105689 at the time of writing; no public PoC, Nuclei template, or exploit code is available.