SSRF Protection Bypass in Lancet Affected Versions by Duke

CVE-2026-110240

What is CVE-2026-110240?

The Lancet product by Duke, up to version 2.3.9, contains a vulnerability in its netutil.IsInternalIP function. This issue misclassifies certain IPv6 addresses, specifically private, link-local, CGNAT, and transition addresses, as external. As a result, attackers could exploit this by providing hostnames that resolve to these incorrectly classified addresses, essentially gaining unauthorized access to internal services or cloud metadata endpoints. This misconfiguration can lead to serious security risks, allowing a potential compromise of sensitive information.

References