PT-2026-37221 · Unknown · Twenty-Server

B-Hermes · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-33975

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 1.18.1

Description An issue in the SecureHttpClientService of twenty-server allows the bypass of Server-Side Request Forgery (SSRF) protections. This occurs because the Node.js URL parser normalizes IPv4-mapped IPv6 addresses into a compressed hex form, while the isPrivateIp utility only recognizes dotted-decimal notation. Consequently, the hex form bypasses the SSRF check. Furthermore, the socket lookup validation event is not triggered for IP literal addresses, bypassing the second layer of validation. An authenticated user can exploit this to access internal IPs, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys.

Recommendations Update to a version later than 1.18.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33975

Affected Products

Twenty-Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33975 · Security Note
• https://github.com/twentyhq/twenty/security/advisories/GHSA-vrcj-hv2q-c58m · Note
• https://twitter.com/CVEnew/status/2051758514666709345 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051760496018112515 · Twitter Post