Answer in brief
CVE-2026-68507 records a Medium severity (CVSS 6.9) vulnerability in ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass. The current sources do not mark it as known exploited. The current feed maps 3xpyth0n/ideon (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps 3xpyth0n/ideon (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| 3xpyth0n/ideongeneric | <0.9.5 | 0.9.5 |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 "any address" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.
Quoted source text, attributed separately from HOL analysis.