Misconfigured TURN Server in Wormhole.app Allows Unauthorized Access
CVE-2026-100251

6.9MEDIUM

Key Information:

Vendor

Wormhole App

Status
Wormhole
Vendor
CVE Published:
1 October 2026

What is CVE-2026-100251?

Wormhole.app, before the update on August 22, 2026, improperly configures its coturn TURN server, which fails to effectively restrict TCP relay peers. This vulnerability permits unauthorized attackers to access sensitive instance metadata or initiate TCP connections using the Wormhole relay's IP address, leading to potential information exposure and privacy concerns.

Affected Version(s)

Wormhole 0 < 2026-08-22

Wormhole 2026-08-22

References

https://wormhole.app/
product
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-100251
vdb-entry

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shreyash Naik
.