CVE-2026-24902

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24902
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24902.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24902
Aliases
  • GHSA-hgr9-frvw-5r76
Published
2026-01-29T21:21:38.878Z
Modified
2026-03-14T12:47:26.333265Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
TrustTunnel has SSRF and private network restriction bypass via numeric address destinations
Details

TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In tcp_forwarder.rs, SSRF protection for allow_private_network_connections = false was only applied in the TcpDestination::HostName(peer) path. The TcpDestination::Address(peer) => peer path proceeded to TcpStream::connect() without equivalent checks (for example is_global_ip, is_loopback), allowing loopback/private targets to be reached by supplying a numeric IP. The vulnerability is fixed in version 0.9.114.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24902.json"
}
References

Affected packages

Git / github.com/trusttunnel/trusttunnel

Affected ranges

Type
GIT
Repo
https://github.com/trusttunnel/trusttunnel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
734bb5cf103b72390a95c853cbf91e699cc01bc0

Affected versions

v0.*
v0.9.100
v0.9.102
v0.9.105
v0.9.109
v0.9.20
v0.9.22
v0.9.23
v0.9.24
v0.9.26
v0.9.27
v0.9.38
v0.9.39
v0.9.40
v0.9.43
v0.9.47
v0.9.74
v0.9.96
v0.9.99

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "0.9.114"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24902.json"