CVE-2026-55473 Details
Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.
A server-side request forgery (SSRF) vulnerability has been identified in HomeBox versions prior to 0.26.0. The issue arises because the application's default protections against bogon networks and cloud metadata IPs do not account for IPv4 addresses embedded in NAT64 prefixes. This oversight allows authenticated users to send 'generic://' notifier URLs that, when processed through a NAT64 gateway, can access internal or cloud metadata services. The vulnerability is exacerbated by the fact that the application incorrectly assumes these crafted URLs are safe, despite the potential for exploitation.
Users can upgrade to HomeBox version 0.26.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysadminsmedia/homebox/commit/42c52f7f7566b7fbd8017352187af20f552a4471 | [email protected] | Source CodeVendor |
| https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0 | [email protected] | Release NotesVendor |
| https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-r9pf-rg22-655m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysadminsmedia Homebox | <= 0.25.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |