CVE-2026-73058: Stoatchat

Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days.

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

Affected products

• Stoatchat Stoatchat: before 0.15.0 (fixed in 0.15.0)

Published 2026-08-16. Last modified 2026-08-31.