CVE-2026-42346CWE-918

Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Medium · published May 8, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-08T22:26Z
EPSS history
Timeline
  • 08 MAY 22:26Z
    Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
    cvelistv5