Is CVE-2026-104458 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104458?

CVE-2026-104458 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-104458

Description

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.