YesWiki: SSRF guard bypass via IPv6 transition addresses
Summary
YesWiki before 4.6.7 contains a server-side request forgery flaw in the keyId validation of ActivityPub Signature headers. The guard does not block 6to4, NAT64 or IPv4-compatible IPv6 addresses that embed internal IPv4 targets. An unauthenticated attacker can send a crafted request to the public actor inbox of a Bazar form and make the server contact cloud metadata services, loopback services or internal hosts. The attack requires ActivityPub to be enabled and 6to4 or NAT64 routing to reach the embedded address.
Affected
- YesWiki versions before 4.6.7 (v4.6.6 and earlier, per the vendor advisory)
- Precondition: ActivityPub enabled on at least one Bazar form
Fixed in
- Upgrade to YesWiki 4.6.7 or later
Workaround
- Disable ActivityPub functionality on Bazar forms until the upgrade is done
- Restrict access to POST /api/forms/{formId}/actor/inbox at a reverse proxy or firewall (effectiveness not verified)
Exploitation
- CISA SSVC data lists exploitation as proof of concept; automatable: no; technical impact: partial
- No evidence of exploitation in the wild was found
- EPSS score is low (0.00317)
Our recommendation
- Upgrade YesWiki to 4.6.7 or later as soon as possible
- Until then, disable ActivityPub on Bazar forms or restrict the inbox endpoint
- Check whether the instance is internet-facing and runs in a cloud environment with metadata services
- Monitor web server logs for POST requests to /api/forms/*/actor/inbox with unusual Signature keyId values
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-85f2-5r47-2pwm github.com
- VulnCheck advisory: YesWiki before 4.6.7 SSRF Guard Bypass www.vulncheck.com
- OSV CVE-2026-104458 osv.dev
- Ionix threat center CVE-2026-104458 www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:17.
Original description (NVD)
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.