PT-2026-5355 · Unknown · Trusttunnel

Megamansec · Published 2026-01-29 · Updated 2026-01-30 · CVE-2026-24902

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions TrustTunnel versions prior to 0.9.114

Description TrustTunnel, an open-source VPN protocol, contains a server-side request forgery and private network restriction bypass. The issue stems from insufficient SSRF protection within the tcp forwarder.rs file. Specifically, the protection for preventing connections to private networks when allow private network connections = false was only applied to hostname-based destinations (TcpDestination::HostName(peer)). The numeric IP address-based destination path (TcpDestination::Address(peer) => peer) bypassed these checks, allowing connections to loopback and private network targets. This bypass occurs because the TcpStream::connect() function is called without equivalent checks like is global ip or is loopback.

Recommendations Update to TrustTunnel version 0.9.114 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-24902

GHSA-HGR9-FRVW-5R76

Affected Products

Trusttunnel

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24902.json · Exploit
• https://github.com/TrustTunnel/TrustTunnel/commit/734bb5cf103b72390a95c853cbf91e699cc01bc0 · Patch
• https://github.com/TrustTunnel/TrustTunnel/security/advisories/GHSA-hgr9-frvw-5r76 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24902 · Security Note
• https://twitter.com/CVEnew/status/2016992611001913353 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017088409844510861 · Twitter Post