IPv6 Transition Address SSRF Bypass in SiYuan

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in its isPrivateIP validation function that fails to recognize IPv6 transition address formats. These transition mechanisms—including NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32)—can embed private IPv4 addresses that bypass SafeMode protections. When SafeMode is enabled to prevent SSRF attacks, authenticated attackers can craft malicious requests using these IPv6 formats to access restricted internal resources, internal services, and cloud metadata endpoints. This vulnerability affects any organization deploying SiYuan before v3.7.4 in environments where IPv6 is available and SafeMode is relied upon for security boundaries.

Casky's 331 matched skills, powered by Claude's extended reasoning across MITRE ATT&CK Initial Access (TA0001) and Execution (TA0006), enable practitioners to detect this attack pattern through multiple angles. Practitioners would identify suspicious reconnaissance activities as attackers probe IPv6 transition addresses, followed by execution attempts using unusual IPv6 CIDR blocks in request logs. The skills map to techniques like External Remote Services exploitation and Command and Scripting Interpreter usage, surfacing anomalies in network requests that bypass standard IP allowlists. Findings would highlight authenticated users making requests to IPv6 addresses outside normal patterns, requests containing 64:ff9b::, 2002::, or 2001:: prefixes, and access attempts to internal IP ranges that should have been blocked—providing the contextual intelligence needed to investigate and contain SSRF exploitation in real time.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-74905.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-74905

Casky has 331 skills that investigate the attack patterns behind CVE-2026-74905. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn