CVE-2026-122140

IPv4-mapped IPv6 can bypass Trawl’s public-target rule

germondai · Trawl optional MCP interface

First documented disclosure · Review checkpoint

Summary

A user can steer an MCP scrape toward an internal destination using an address spelling the filter misses.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer tested against owned fixtures and did not contact live metadata services or third-party private networks. Malicious exploitation is unestablished.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The URL policy incorrectly classified some IPv4-mapped IPv6 encodings as public. A submitted URL or a redirect could reach a restricted address.

Conditions required

MCP is enabled and the caller can submit a target or control a redirect. The destination must be reachable from Trawl.

Potential impact

The service may return responses from internal services, including a metadata endpoint if its own access controls allow it.

Affected versions and configurations

1.5.0 through 1.9.3, per the maintainer.

Fix and mitigation status

1.10.0 enforces numeric address classification and pins the allowed connection target.

Practical next steps

Upgrade to a release containing the fix. Restrict egress from MCP and test both initial URLs and redirect destinations.

Operating lesson

Validate the numeric network destination at connection time, including after each redirect.

Evidence and limits

The November 3 patch, release and advisory precede the November 4 CVE. The native administrative API intentionally supports private targets. The maintainer references a separate DNS-rebinding advisory.

Sources