{"id":"CVE-2026-76171","published":"2026-11-06T12:17:21.910","lastModified":"2026-11-10T19:21:22.310","description":"In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.\nUsers are recommended to upgrade to version 3.9.1 which fixes this issue.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/goj9xc05nbk1dp0z2g3r264j537lvx9r","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/17","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache James server versions prior to 3.9.1 contained improper validation in the JMAP webPush feature that allowed Server-Side Request Forgery (SSRF), enabling attackers to reach internal network addresses from the server.","exploitability":"Exploitation requires network access to the JMAP webPush endpoint and knowledge of internal IP ranges or services, but no authentication or user interaction is needed.","blast_radius":"Successful exploitation could allow an attacker to probe or interact with internal services, potentially leading to data exfiltration or lateral movement within the internal network.","remediation":"Upgrade to Apache James server version 3.9.1 immediately.","detection":"Defenders should monitor for outbound HTTP/HTTPS requests from the James server to non-public IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or localhost addresses in JMAP-related logs; unusual timing or frequency of such requests may indicate SSRF attempts.","tags":["ssrf","webpush","jmap","apache-james","internal-probing"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:57:59.897Z"}}