CVE-2026-100251 — Wormhole.app SSRF
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access in…
Published: 2026-10-01 · CVSS: 6.9 · CVSS 4.0
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7