CVE-2026-82476
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 29, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 29, 2026
Description
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
memosusememos |
|
References
- GitHub Issue #6099issue-tracking
- https://github.com/usememos/memos/blob/v0.30.0/internal/httpgetter/html_meta.gotechnical-description
- https://github.com/usememos/memosproduct
- VulnCheck Advisory: Memos through 0.30.0 SSRF via Omitted CGNAT Address Rangethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.