CVE-2026-85738

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.

• CWE-918

• https://github.com/liketrek/TREK/commit/a2bd9be184a94997105ce190dad920c41e7b10df
• https://github.com/liketrek/TREK/pull/1540
• https://github.com/liketrek/TREK/releases/tag/v3.4.0
• https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85725LightRAG provides simple and fast retrieval-augmented genera…5.9
• CVE-2026-8573Integer overflow in Codecs in Google Chrome on Windows prior…8.3
• CVE-2026-85730smol-toml is a small, fast, and correct TOML parser and seri…8.2
• CVE-2026-85731oras-go is a Go library for managing OCI artifacts. Prior to…8.8
• CVE-2026-85732oras-go is a Go library for managing OCI artifacts. Prior to…4.7
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.16…8.3
• CVE-2026-85750Piwigo before v16.4.0 is vulnerable to arbitrary file read a…7.2
• CVE-2026-85751Mailu is a mail server distributed as a set of Docker images…9.8
• CVE-2026-85756SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2…7.5