CVE-2026-24902 - TrustTunnel has SSRF and private network restriction bypass via numeric address ...

CVE ID : CVE-2026-24902 Published : Jan. 29, 2026, 9:21 p.m. | 38 minutes ago Description : TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path. The `TcpDestination::Address(peer) => peer` path proceeded to `TcpStream::connect()` without equivalent checks (for example `is_global_ip`, `is_loopback`), allowing loopback/private targets to be reached by supplying a numeric IP. The vulnerability is fixed in version 0.9.114. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...