CVE-2026-100251

6.5 MEDIUM

Published 2026-10-01 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-918

All references

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json
https://wormhole.app/
https://www.cve.org/CVERecord?id=CVE-2026-100251

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37278PoC
HIGHCVE-2023-54402PoC
MEDIUMCVE-2024-34319
UNSCOREDCVE-2026-0311
LOWCVE-2026-100104
MEDIUMCVE-2026-100257
MEDIUMCVE-2026-100279
MEDIUMCVE-2026-100297

Related by shared AI tags and CWE weakness class. Browse the full archive.