CVE-2026-100355 Details
Description
Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.
A server-side request forgery (SSRF) vulnerability has been identified in the Campfire web-based chat application, specifically in versions through 1.4.4. The issue arises in the OpenGraph link preview feature, where the server fetches linked content. The 'RestrictedHTTP::PrivateNetworkGuard' failed to adequately block requests to internal resources from links resolving to certain special-use IP ranges, including CGNAT, NAT64, and 6to4. This vulnerability allows authenticated users to manipulate link previews into accessing internal network resources. While the confidentiality impact is limited to OpenGraph metadata, which is typically absent from most internal endpoints, the vulnerability could be exploited to bypass network protections and access sensitive resources.
Users can upgrade to Campfire version 1.4.5 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the Campfire repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/basecamp/once-campfire/commit/69e8cd788593cf421c32626a5273c0b449ceee9b | [email protected] | Source CodeVendor |
| https://github.com/basecamp/once-campfire/pull/225 | [email protected] | Issue TrackingVendor |
| https://github.com/basecamp/once-campfire/releases/tag/v1.4.5 | [email protected] | Release NotesVendor |
| https://github.com/basecamp/once-campfire/security/advisories/GHSA-gjm7-g266-w3wj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Basecamp Campfire | <= 1.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |