Description

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-29T17:18:00.197Z",
  "pubdate": "2026-08-29T17:18:00.197Z",
  "executiveSummary": "Memos versions up to and including 0.30.0 contain a Server-Side Request Forgery (SSRF) vulnerability within the link-metadata fetcher component. The issue stems from an incomplete denylist of internal IP address ranges, specifically omitting the 100.64.0.0/10 Carrier-Grade NAT (CGNAT) address space. This failure allows the application to resolve and interact with resources that should be restricted.\nThe vulnerability allows unauthenticated attackers to force the Memos server to initiate outbound HTTP requests to arbitrary destinations within the CGNAT range. This poses a significant risk, as attackers can interact with internal network services, cloud metadata endpoints, and other private infrastructure. Successful exploitation enables unauthorized data exfiltration, as the application returns the titles and descriptions of the requested pages back to the attacker. Given the nature of cloud environments where CGNAT addresses are frequently routed to sensitive metadata services, this vulnerability represents a high-severity security risk for self-hosted instances operating within cloud-native architectures.",
  "technicalDetails": "The root cause of this vulnerability is an improperly implemented IP validation mechanism within the Memos link-metadata fetcher. When a user provides a URL for metadata retrieval, the application performs a lookup to validate the target destination against a blocklist of reserved or internal IP address ranges. However, the validation logic fails to include the 100.64.0.0/10 range defined in RFC 6598, which is reserved for shared address space (CGNAT).\nBecause the validation check is incomplete, the underlying fetcher function treats addresses within the 100.64.0.0/10 block as external, routable, and legitimate targets. An unauthenticated attacker can supply a crafted URL pointing to an internal resource residing within this range. The attack flow proceeds as follows: First, the attacker identifies or guesses an internal IP address within the CGNAT range that hosts a service of interest, such as an internal cloud metadata API (e.g., 100.64.x.x). Second, the attacker submits this URL to the Memos metadata fetcher endpoint. Third, the Memos server, acting as a proxy, initiates an HTTP request to the specified IP. Finally, the server processes the response and extracts metadata, such as the HTML <title> tag and description, which is then rendered or returned to the attacker's client.\nThis vulnerability is particularly dangerous in cloud-hosted environments (e.g., AWS, GCP, Azure), where internal services often leverage non-standard or CGNAT-adjacent ranges to expose management interfaces or instance metadata. By bypassing the IP restriction, an attacker can conduct internal network reconnaissance and potentially extract sensitive configuration information or tokens. The requirement for exploitation is minimal, as it does not require authentication or elevated privileges within the Memos instance; the fetcher is accessible to any user capable of triggering the link-metadata request. The scope of impact is limited to the server-side request context, but the ability to read back page titles and descriptions provides a feedback loop that simplifies the identification of active internal services."
}