All vulnerabilities
CVE-2026-100251

Wormhole.app SSRF

Wormhole App Wormhole
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026-08-22Fixed versionCVE List
Published1 Oct 2026Updated 11 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

Text from CVE List

Affected versions 2

  • Wormholeaffected: all versions before 2026-08-22CVE List
  • Wormholeunaffected: 2026-08-22CVE List

References 3