OpenGraph Metadata Exposure in Campfire Web-Based Chat Application

CVE-2026-100355

What is CVE-2026-100355?

The Campfire web-based chat application has a vulnerability that arises when messages containing links trigger the server to fetch them for OpenGraph previews. This process inadequately checks for specific IP addresses using Ruby's predicates, which allows an authenticated user to post links that resolve to internal network resources through certain IP ranges, effectively bypassing security measures. Though the exposure primarily involves returning OpenGraph metadata—typically non-confidential—the risk exists for links mapped to internal resources. A patch has been introduced in version 1.4.5 to mitigate this issue.

References