CVE-2026-54494

Received Received - Intake

SSRF via RSS Enclosure in Koel Music Streaming

Publication date: 2026-08-19

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-25

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54494

Affected Vendors & Products

Vendor	Product	Version / Range
koel	koel	9.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Koel before version 9.7.1 has a vulnerability where the function App\Helpers\Network::isPublicHost() incorrectly treats NAT64 and 6to4 IPv6 addresses as public. This allows an authenticated user to input such an address in a podcast RSS feed enclosure URL. The application then fetches the URL, potentially exposing internal services or cloud metadata to the user.

Detection Guidance

Check Koel version with 'composer show koel/koel' or 'php artisan koel:version'. If version is below 9.7.1, the system is vulnerable. Inspect network logs for outbound requests to NAT64 (64:ff9b::/96) or 6to4 (2002::/16) addresses from Koel processes.

Impact Analysis

If you run Koel with NAT64 or 6to4 routing, an attacker could trick your server into fetching internal resources or cloud metadata by providing a specially crafted podcast URL. This could lead to data leaks or unauthorized access to internal services.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements. Organizations using Koel must ensure they are running patched versions to maintain compliance.

Mitigation Strategies

Upgrade Koel to version 9.7.1 or later immediately. If immediate upgrade is not possible, restrict outbound IPv6 traffic from Koel to trusted destinations or disable IPv6 support temporarily until patching.

Hi! I’m here to help you understand CVE-2026-54494. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70