CVE-2026-100251

MEDIUMCVSS 6.5

Description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

Timeline

Published:October 1st, 2026 8:17 PM

Last modified:October 11th, 2026 5:16 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-918

References & Reports

Advisories, patches, and third-party reports

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json
https://wormhole.app/
https://www.cve.org/CVERecord?id=CVE-2026-100251

Source: NIST NVD · Data may lag official sources by up to one minute