VDB
GCVE-110-TWILIO-2026-0010
GCVE-110-TWILIO-2026-0010
Advisory Published
<p>On <b>September 15, 2026</b>, Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1). This is part of a move from a single shared IP range to dedicated regional addresses, bringing Event Streams in line with how the rest of the Twilio platform routes traffic.</p>
<p>This change only affects customers who validate incoming Event Streams webhook traffic by source IP address. If a setup doesn’t check the source IP, no action is needed.</p>
<p> </p>
<p><b>What’s changing with Event Streams IP addresses?</b></p>
<p>The new subnet for US East is 3.80.20.0/25, covering the range 3.80.20.0 – 3.80.20.127.</p>
<p>Customers who do validate by source IP can add the new US East range to their allowlist on September 15, 2026. The existing shared range (35.90.102.128/25) will remain active alongside the new addresses for now. Twilio will publish a follow-up changelog entry when it’s safe to remove the legacy range.</p>
<p>Additional regional IP addresses for other Twilio Regions will be shared as they become available.</p>
<p> </p>
<p><b>Need a hand?</b></p>
<p>Learn more in the <a href="https://www.twilio.com/docs/events/webhook-quickstart#security">Event Streams webhook security documentation</a> and <a href="https://www.twilio.com/docs/iam/twilio-editions/twilio-static-proxy#ip-addresses-and-ranges">Twilio Editions static proxy IP addresses</a>.</p>
<p> </p>
References
Browse GCVE Records
67,954 records in the GCVE database · Updated August 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.