{"schema":"threatline.record/2","record":{"id":"CVE-2026-100251","aliases":[],"summary":"Wormhole.app SSRF","details":"Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.","categories":["Unclassified"],"product":"Wormhole","vendor":"Wormhole App","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100251","source_modified_at":"2026-10-11T17:05:29.805Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Wormhole","vendor":"Wormhole App","versions":[{"version":"0","status":"affected","lessThan":"2026-08-22","versionType":"custom"},{"version":"2026-08-22","status":"unaffected"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100251","source_modified_at":"2026-10-11T17:05:29.805Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Wormhole","ecosystem":null},"version":"2026-08-22","basis":"first unaffected version stated in the CVE record"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00258,"percentile":0.16567,"score_date":"2026-10-23"},"published_at":"2026-10-01T19:44:16.396Z","modified_at":"2026-10-11T17:05:29.805Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100251","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T17:05:29.805Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100251","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wormhole.app/","tags":["product"]},{"source":"CVE List","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100251","tags":["vdb-entry"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-11T16:54:02.389171Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T17:05:29.805Z","content_hash":"5d8ee8f471cf8b5812aee7ccb33e53b96c18ca8b2f86df1559937dcc5a9b6982"}}