{"id":"CVE-2026-79659","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-79659","generatedAt":"2026-10-28T03:27:59.281Z","title":"Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation.","description":"Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.","published":"2026-08-25T12:16:29.000Z","lastModified":"2026-10-08T16:17:45.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.3,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-918"],"affected":[],"epss":{"score":0.00354,"percentile":0.28815,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ech0-before-server-side-request-forgery-via-fetchpeerconnectinfo","source":"disclosure@vulncheck.com"},{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-8mc6-xjpr-h98x","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-79659","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}