Server-Side Request Forgery in Koel Music Streaming

Executive Summary

CVE-2026-50552 is a Server-Side Request Forgery (SSRF) vulnerability in Koel versions prior to 9.7.1, specifically affecting the radio station creation endpoint (POST /api/radio/stations).

The vulnerability arises because the URL validation rules lack the 'bail' keyword, causing the HasAudioContentType rule to execute HTTP requests to the supplied URL even after the SafeUrl rule has rejected URLs pointing to private or reserved addresses.

This allows any authenticated, non-admin user to coerce the server into making HEAD or GET requests to arbitrary internal hosts, effectively enabling blind SSRF.

Additionally, the server provides distinct validation error messages that act as an internal-network reachability oracle, allowing attackers to enumerate live hosts and open ports behind the firewall.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-50552 vulnerability in Koel allows authenticated, non-admin users to coerce the server into making HTTP requests to arbitrary internal hosts, potentially enabling internal network reconnaissance and triggering state-changing internal endpoints.

While the vulnerability impacts confidentiality, integrity, and availability at a low level, there is no explicit information provided about direct effects on compliance with common standards and regulations such as GDPR or HIPAA.

However, since the vulnerability could allow unauthorized internal network access and information gathering, it may indirectly affect compliance by increasing the risk of unauthorized data exposure or system manipulation, which are concerns under regulations like GDPR and HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated, non-admin user to make the server send HTTP requests to arbitrary internal hosts, potentially exposing internal network information.

Attackers can use this to discover live hosts and open ports within your internal network, which can aid in further attacks or reconnaissance.

Moreover, the vulnerability allows triggering state-changing internal endpoints via side-effect requests, which could lead to unauthorized actions within the internal network.

The overall impact includes low but non-negligible confidentiality, integrity, and availability risks, with a CVSS score of 6.3 indicating medium severity.

Useful 0 Not Useful 0

Detection Guidance

This SSRF vulnerability in Koel allows authenticated, non-admin users to coerce the server into making HEAD/GET requests to arbitrary internal hosts via the radio station creation endpoint (POST /api/radio/stations). Detection can be performed by monitoring for unusual outbound HTTP requests originating from the Koel server to internal or unexpected hosts.

Since the vulnerability provides distinct validation error messages that act as an internal-network reachability oracle, you can detect attempts by looking for repeated validation errors related to URL submissions in the application logs.

Suggested commands to detect suspicious activity include:

• Use network monitoring tools like tcpdump or Wireshark to capture outbound HTTP requests from the Koel server, filtering for requests to internal IP ranges.
• Example tcpdump command: sudo tcpdump -i <interface> 'tcp and (dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16) and (tcp dst port 80 or tcp dst port 443)'
• Check Koel application logs for repeated POST requests to /api/radio/stations with URL validation errors indicating internal host reachability attempts.
• Use curl or similar tools to test the endpoint with crafted URLs to see if the server issues requests to internal hosts and returns distinct validation errors.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Koel to version 9.7.1 or later, where this SSRF vulnerability has been patched by adding the 'bail' keyword to the URL validation rules and strengthening host validation.

If immediate upgrade is not possible, consider restricting access to the radio station creation endpoint to trusted users only, and monitor for suspicious activity.

Additional mitigation steps include:

• Implement network-level controls to restrict the Koel server from making outbound HTTP requests to internal or sensitive network ranges.
• Apply firewall rules or egress filtering to prevent unauthorized internal host scanning or access.
• Review and apply the security fixes from the commit addressing this issue, which include IP pinning, stricter IPv6 validation, and improved URL validation.

Useful 0 Not Useful 0