CVE-2026-73210

Executive Summary

CVE-2026-73210 is a Server-Side Request Forgery (SSRF) vulnerability in Lookyloo's PlaywrightCapture component, affecting deployments that enable the only_global_lookup option. The flaw exists in the favicon retrieval path: favicon URLs extracted from rendered HTML are fetched directly with an aiohttp.ClientSession, outside the browser request-routing protections, enabling a crafted webpage to trigger HTTP requests to loopback, private, or otherwise non-public addresses. Successful exploitation allows internal service discovery and interaction with internal HTTP endpoints reachable only from the capture host; no CVSS score is published, the CWE is 918, and the vulnerability is not listed in CISA KEV.

Technical Analysis

SSRF vulnerabilities occur when a server-side component follows attacker-influenced URLs and issues requests to destinations the operator never intended to make reachable. In this case, Lookyloo's PlaywrightCapture is a headless-browser capture component that processes web pages supplied by users of the Lookyloo platform. The only_global_lookup option was designed as a protective control: when enabled, PlaywrightCapture is supposed to prevent captures from accessing local, loopback, or otherwise non-public network resources — a classic SSRF guardrail.

The vulnerability arises from an architectural gap. The browser request-routing protections controlled by only_global_lookup apply to the Playwright capture engine itself, but favicon retrieval was implemented as a separate routine. During page processing, favicon URLs are extracted from the rendered HTML of the captured page. These URLs are then resolved and fetched directly by an HTTP client — an aiohttp.ClientSession — notably outside the browser request-routing protections. This means the access-control logic enforced during browser navigation (e.g., blocking 127.0.0.1, RFC 1918 ranges, link-local addresses) does not apply to the favicon fetcher.

The consequence is a filter bypass: a page that is otherwise rendered with only_global_lookup restrictions in effect can carry a <link rel="icon">-style reference pointing to http://127.0.0.1:<port>/, a private IP such as http://10.0.0.5/, a .local mDNS hostname, or a cloud metadata address such as http://169.254.169.254/. When PlaywrightCapture processes that page, the favicon routine will issue an HTTP request to the non-public destination despite the option being enabled.

From the description, the vulnerable data flow is:

1. User submits a URL (or otherwise causes a page to be processed) to a Lookyloo instance running PlaywrightCapture with only_global_lookup enabled.
2. The browser renders the page; an attacker-controlled document supplies a crafted favicon reference.
3. The page-processing pipeline extracts the favicon URL from the rendered HTML.
4. The favicon retrieval routine, separate from browser request-routing, resolves and fetches the URL directly using aiohttp.ClientSession.
5. The request reaches a loopback/private/non-public destination, bypassing the only_global_lookup control.

The described patch introduces a common URL validation routine and applies it to favicon retrieval. Per the NVD description, the validation rejects direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations.

It is important to note the limits of the available data: no CNA title, no version range, and no code-level identifiers (function names, file paths, endpoints) are provided beyond the components named above (PlaywrightCapture, only_global_lookup, aiohttp.ClientSession). The OSV package entry lists the affected package as unfixed (0→unfixed), and the patch claim is at confidence 2/4 (single source, not independently confirmed).

Exploitation Scenarios

No public PoC or exploit code is available (status: UNKNOWN). The attack chain below is inferred strictly from the vulnerability class (CWE-918) and the NVD description.

Step 1 — Reconnaissance / target identification. An attacker identifies an internet-facing Lookyloo instance. Since Lookyloo is a web-capture platform, a public instance may be discovered via web-searching (e.g., for instances of the Lookyloo web UI) or by fingerprinting the application on non-standard ports. The attacker then verifies that the instance processes user-supplied URLs.

Step 2 — Triggering the vulnerable code path. The attacker supplies a URL that they control — for example, an attacker-operated website or a page with user-influenced HTML — and submits it to the Lookyloo capture queue. The capture is processed by PlaywrightCapture with only_global_lookup enabled, which is the precise configuration in which the bypass manifests.

Step 3 — Payload / execution mechanism. Within the attacker-controlled HTML, a crafted favicon reference is embedded. At the vulnerability-class level, this is a URL pointing to a non-public resource: http://127.0.0.1/<path>, http://10.x.x.x/, http://192.168.x.x/, http://169.254.169.254/ (cloud metadata), or a .local hostname. During processing, the favicon extraction routine pulls this URL from the rendered HTML and fetches it via aiohttp.ClientSession, thereby issuing an HTTP request from the PlaywrightCapture host to the internal destination. Because the request is made by the separate favicon routine, the only_global_lookup routing protections are never applied.

Step 4 — Post-exploitation impact. The attacker induces the capture host to interact with internal network services. Depending on the targeted service, this enables: (a) internal service discovery — probing ports on loopback or internal subnets, distinguishing open vs. closed ports via response or timing differences; (b) access to internal resources — retrieving documents, configuration files, or management interfaces that respond over HTTP; (c) interaction with HTTP endpoints available only from the capture infrastructure, including state-changing operations where the internal service does not enforce additional authentication. Cloud-deployed capture hosts additionally expose the instance metadata service at 169.254.169.254, a common target for credential harvesting. The favicon response itself may be consumed as a page asset, but the primary value to the attacker is the outbound request primitive itself.

Impact Assessment

The business impact is governed by the network position of the Lookyloo host. Lookyloo instances deployed inside a corporate network or in a cloud environment give an attacker an indirect foothold into internal HTTP services that would otherwise be unreachable from the internet. The described impact — internal service discovery, access to internal resources, and interaction with internal HTTP endpoints — maps to confidentiality and integrity concerns: internal data may be read, and internal endpoints (potentially including administrative or automation interfaces) may be invoked.

The blast radius is bounded by the network reachable from the PlaywrightCapture host, which in some deployments may be substantial (e.g., a capture server with broad internal network access). The risk is amplified in cloud deployments because the link-local metadata service (169.254.169.254) is a one-request credential exfiltration vector in many environments.

There is no CVSS score or vector published, which limits quantitative risk comparison. EPSS is 0.00422 (35.3rd percentile of exploited CVEs), indicating low near-term exploitation probability in the wild. CISA KEV does not list this CVE, and no known threat actor campaigns or in-the-wild exploitation have been reported. The absence of a fixed version (OSV entry: unfixed) and only a single-source patch claim (confidence 2/4) mean affected operators should treat this as unpatched and prioritize compensating controls.

Detection Guidance

Detection of CVE-2026-73210 centers on two observables observable from the network: (1) the Lookyloo capture host opening outbound HTTP connections to loopback, RFC 1918, link-local, or .local destinations; and (2) HTTP responses or proxy logs revealing outbound requests whose URI contains "favicon" and whose Host header or URL contains a non-public address. The detection rules below target those signals.

Sigma Rule

title: Lookyloo PlaywrightCapture SSRF via Favicon Retrieval (CVE-2026-73210)
id: cce2f6a4-8c1b-4f3e-9d20-7b0ac1e4d732
status: experimental
description: >
  Detects outbound TCP connections from a Lookyloo PlaywrightCapture (python)
  process to loopback, RFC1918, link-local, or other non-public IP addresses.
  Consistent with SSRF exploitation through the favicon retrieval path described
  in CVE-2026-73210, where favicon URLs are fetched outside the
  only_global_lookup browser request-routing protections.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73210
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
    category: network_connection
    product: linux
detection:
    selection_process:
        Image|endswith:
            - '/python3'
            - '/python'
        CommandLine|contains:
            - 'lookyloo'
            - 'playwright'
    selection_destination:
        DestinationIp|startswith:
            - '127.'
            - '10.'
            - '192.168.'
            - '169.254.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.2'
            - '172.30.'
            - '172.31.'
    condition: selection_process and selection_destination
falsepositives:
    - Lookyloo instances legitimately proxying or capturing internal content
      (rare; most deployments restrict captures to public web resources)
level: high
tags:
    - attack.t1190
    - cve.2026-73210
    - cwe.918

YARA Rule

rule CVE_2026_73210_Lookyloo_SSRF_Favicon
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects HTML content embedding favicon references to loopback, RFC1918, link-local, or .local addresses, characteristic of payloads targeting CVE-2026-73210 (Lookyloo PlaywrightCapture SSRF via favicon retrieval)."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-73210"
        cve         = "CVE-2026-73210"
        date        = "2026-01-01"
    strings:
        $favicon_tag = /<link[^>]*(?:rel\s*=\s*["']?(?:shortcut\s+)?icon["']?|href\s*=\s*["'][^"']*favicon[^"']*["'])[^>]*>/i
        $localhost   = /href\s*=\s*["']https?:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?[\/"']/i
        $rfc1918_10  = /href\s*=\s*["']https?:\/\/10\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?[\/"']/i
        $rfc1918_192 = /href\s*=\s*["']https?:\/\/192\.168\.\d{1,3}\.\d{1,3}(?::\d+)?[\/"']/i
        $rfc1918_172 = /href\s*=\s*["']https?:\/\/172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}(?::\d+)?[\/"']/i
        $linklocal   = /href\s*=\s*["']https?:\/\/169\.254\.\d{1,3}\.\d{1,3}(?::\d+)?[\/"']/i
        $dotlocal    = /href\s*=\s*["']https?:\/\/[^\s"']+\.local(?::\d+)?[\/"']/i
    condition:
        any of ($localhost, $rfc1918_10, $rfc1918_192, $rfc1918_172, $linklocal, $dotlocal) and
        $favicon_tag
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73210 Lookyloo PlaywrightCapture SSRF via favicon request to non-public IP"; flow:established,to_server; content:"favicon"; http.uri; nocase; pcre:"/https?:\/\/(127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)/Ui"; http.host; shadow:http.host; classtype:attempted-recon; reference:cve,2026-73210; sid:2026732100; rev:1; metadata:created_at 2026-01-01, mitre_attack_technique T1190;)

Note: operators should additionally consider a plain TCP rule matching any outbound SYN from the Lookyloo capture host toward 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16, which covers non-HTTP probe behavior not captured by the HTTP-layer rule.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and
     process.name : ("python3", "python") and
     process.command_line : ("*lookyloo*", "*playwright*")]
  [network where event.type == "connection" and
     destination.ip : ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12",
                       "192.168.0.0/16", "169.254.0.0/16")]

Splunk SPL Query

index=proxy OR index=stream:http
| search (dest_ip="10.0.0.0/8" OR dest_ip="172.16.0.0/12" OR dest_ip="192.168.0.0/16" OR dest_ip="127.0.0.0/8" OR dest_ip="169.254.0.0/16")
| search uri=*favicon* OR http_uri=*favicon* OR url=*favicon*
| where cidrmatch("127.0.0.0/8", dest_ip) OR cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip) OR cidrmatch("169.254.0.0/16", dest_ip)
| stats earliest(_time) latest(_time), count by src_ip, dest_ip, url, http_host, src_host, user_agent
| sort - count

Wazuh OSSEC Rule

<group name="ssrf,cve-2026-73210,">
  <rule id="100732" level="12">
    <if_sid>5715</if_sid>
    <field name="audit.data.addr" type="pcre2">^(127\.0\.0\.1|10\.|192\.168\.|169\.254\.)</field>
    <description>Lookyloo PlaywrightCapture host attempted outbound connection to a non-public IP address (possible CVE-2026-73210 SSRF via favicon retrieval)</description>
    <group>ssrf,attack.t1190</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — single source, OSV, not independently confirmed), and the OSV package entry lists the package as unfixed with no confirmed fixed version. Operators should therefore assume the flaw remains present until verified otherwise.

1) Immediate mitigations:

• Enforce egress filtering on the Lookyloo capture host: block outbound connections to loopback (127.0.0.0/8), RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and .local resolution at the host firewall or cloud security group. This directly neutralizes the SSRF primitive even if the code remains unpatched.
• Deploy Lookyloo capture infrastructure in an isolated network segment or dedicated security zone with no route to internal production networks.
• Restrict public access to Lookyloo instances; if the instance need not accept arbitrary user-submitted URLs, place it behind an allowlist or authentication so that only trusted parties can trigger captures.
• If a forward proxy is used, configure it to reject requests containing loopback/private/link-local hosts.

2) Patch/upgrade steps:

• Monitor OSV and the upstream Lookyloo project for the official fix; validate the single-source patch claim that a common URL validation routine is now applied to favicon retrieval.
• When a patched version is published, upgrade PlaywrightCapture / Lookyloo in a staging environment, re-test the only_global_lookup behavior with a crafted loopback favicon payload, and only then deploy to production.
• Until a verified fixed version exists, treat the vulnerability as unpatched regardless of the 2/4 confidence claim.

3) Long-term hardening:

• Apply least-privilege segmentation so the capture host can only reach the internet, with all internal access mediated by an explicit proxy.
• Implement SSRF protection at the HTTP-client layer as a matter of policy, ensuring every fetch path (not just the browser routing) goes through a common URL validator — the same class of fix described in the patch.
• Conduct a code review of all auxiliary network-touching routines (asset fetch, favicon, preview, DNS resolution) for similar bypass paths.
• Retain network telemetry for outbound connections from the capture host to support post-incident reconstruction.

References

1. NVD — CVE-2026-73210: https://nvd.nist.gov/vuln/detail/CVE-2026-73210
2. OSV Vulnerability Database — CVE-2026-73210: https://osv.dev/vulnerability/CVE-2026-73210
3. MITRE CVE Record — CVE-2026-73210: https://www.cve.org/CVERecord?id=CVE-2026-73210
4. MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
5. Lookyloo project (upstream product): https://github.com/Lookyloo/lookyloo

No vendor advisory, researcher blog post, CISA KEV entry, or known threat-actor campaign is currently available for this CVE. No in-the-wild exploitation evidence has been reported.