CVE-2026-107449CWE-918ssrf

CVE-2026-107449

Low · published October 8, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-08T09:17Z
References (2)
https://github.com/kashishtopi/heimdall-unauth-ssrf · [email protected]https://github.com/linuxserver/Heimdall/blob/9ad5864a80d7025db1e6eab8eb2981c165b0ddff/app/SupportedApps.php · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 08 OCT 04:28Z
    linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats…
    cvelistv5
  • 08 OCT 04:28Z
    linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats…
    cvelistv5