Pixelfed - Authenticated SSRF via Remote URL Search
CVSS score
4.3
EPSS probability
%0.3
Risk score
0.0
Published
2 mo ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
0/2
Evidence confidence
%50
Short explanation
Pixelfed's SearchController allows authenticated users to trigger a semi-blind SSRF via remote-search parameter due to insufficient IP validation and DNS checks. No public exploit or patch is confirmed. CVSS score is 5.7 (MEDIUM). Patch status is UNKNOWN. CVE-2026-71246 is reported in cvelist and nvd with conflicting CVSS scores.
This vulnerability allows authenticated users to perform SSRF attacks with limited visibility, potentially leading to internal service access. It is exploitable without requiring privilege escalation. No patch status is confirmed, and the vulnerability remains unmitigated in production environments.
1 alanda kaynak uyuşmazlığı var. DayBreach bu değerleri saklamadı; kaynak karşılaştırması aşağıda gösteriliyor.
Chain of evidence and sources
Pixelfed'in SearchController'sı, kimlik doğrulama ortamında yer alır ve remote-search parametresi aracılığıyla bir uzak URL'yi sunucu tarafında alır. ActivityPubFetchService'de validateUrl() yöntemi sadece 127.0.0.1, localhost ve ::1 gibi literal host'ları engeller, HTTPS gerektirir ve çözülen IP adreslerini özel, iç veya link-local aralıklarla karşılaştırır. Opsiyonel DNS doğrulaması varsayılan olarak devre dışıdır ve etkin hâlde sadece DNS kaydının varlığını kontrol eder. Cevap gövdesi, Content-Type'in ActivityPub içerik türünü karşıladığı durumda kullanıcıya döner, bu nedenle her kimlik doğrulamış kullanıcıya açık bir yarı-görünür SSRF (Server-Side Request Forgery) primitive'ini sağlar.
açık'ın CVSS 3.1 temel puanı 5.7 (MİD) ve CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N vektörüdür. CISA'nın KEV'inde yer almaz ve açık bir istismar veya yama durumu doğrulanmamıştır. Yama değerlendirmesi, üretici bilgilerinin eksik olması nedeniyle BİLİNMEYEN (UNKNOWN) durumdadır.
CVE-2026-71246, cvelist ve nvd tarafından bildirilmiştir ve CVSS puanları (5.7 vs 4.3) çelişkili olup, her iki kaynak da aynı teknik detayları ve Pixelfed GitHub deposunu ana kaynak olarak belirtmektedir.
Show the technical text from the sources
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254).
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE: CWE-918
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-71246 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | pixelfed | pixelfed | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 4.3 | CVSS V3_1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CVE CNA |
| 4.3 | CVSS V31 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-71246 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-71246 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-71246"