Description (CNA)
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Wormhole App / Wormhole | affected 0 before 2026-08-22; unaffected 2026-08-22 |
CWE
CWE-918
References
- https://wormhole.app/
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json
- https://www.cve.org/CVERecord?id=CVE-2026-100251
ADP enrichment
No English description supplied.
No references supplied.