Server-side Request Forgery Vulnerability in Ideon by 3xpyth0n
CVE-2026-65968

5.3MEDIUM

Key Information:

Vendor

3xpyth0n

Status
Ideon
Vendor
CVE Published:
11 November 2026

What is CVE-2026-65968?

Ideon, a self-hosted visual workspace developed by 3xpyth0n, is susceptible to a Server-side Request Forgery vulnerability that affects versions prior to 0.9.4. The implementation of URL validation within the src files can incorrectly allow unauthenticated users to register a STREAMABLE_HTTP or SSE MCP server with specific IPv4-mapped-IPv6 URLs. This oversight enables an attacker to retrieve sensitive data from internal services by crafting a URL that passes the initial validation, ultimately leading to unauthorized access and potential data leakage. The issue has been addressed in version 0.9.4, where improved validation ensures that such exploit attempts are effectively mitigated.

Affected Version(s)

ideon < 0.9.4

References

https://github.com/3xpyth0n/ideon/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24...
x_refsource_MISC
https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.