CVE-2026-79659
Last modified
CVE-2026-79659 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| lin-snow | Ech0 | < 4.7.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-79659?
How severe is CVE-2026-79659?
How do I fix CVE-2026-79659?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-79652A flaw was found in the JWT Bearer authorization grant imple…5.9
- CVE-2026-79653In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20…6
- CVE-2026-79654A flaw was found in Katello where the Content View History A…4.3
- CVE-2026-79655A flaw was found in sos clean, a utility within the sos pack…7.8
- CVE-2026-79657NLTK versions before 3.10.3 contain a remote code execution …9.8
- CVE-2026-79658Ech0 before 5.0.1 does not impose any size or shape limit on…7.5
- CVE-2026-7966Insufficient validation of untrusted input in SiteIsolation …3.1
- CVE-2026-79660Ech0 versions before 4.7.3 expose guest commenter email addr…5.3
- CVE-2026-79661Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endp…6.5
- CVE-2026-79662Ech0 through 4.5.6 contains an OAuth redirect URI validation…8
- CVE-2026-79663Ech0 before 4.7.3 contains a stored cross-site scripting vul…4.8
- CVE-2026-79664Ech0 before 4.7.3 fails to properly revoke access tokens cre…7.4
Are you affected by CVE-2026-79659?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST