CVE-2026-71246
Received Received - Intake

Server-Side Request Forgery in Pixelfed via ActivityPubFetchService

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl() only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254). Optional DNS validation is disabled by default and, when enabled, only confirms a DNS record exists without filtering by IP range. The fetch response body is returned to the requester only when the Content-Type matches an ActivityPub content type, making this a semi-blind but authenticated SSRF primitive reachable by any logged-in user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71246
EUVD
EUVD-2026-53319

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pixelfed pixelfed *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Pixelfed. It allows authenticated users to make the server fetch remote URLs via ActivityPub. The server only blocks localhost and 127.0.0.1 but does not check for private or internal IP ranges. This creates a semi-blind SSRF where attackers can trigger requests to internal systems or specific endpoints.

Detection Guidance

Detecting this vulnerability requires checking Pixelfed's configuration for improper URL validation in the SearchController. Review server logs for unusual outbound requests to internal or private IP ranges from the application. Check if ActivityPubFetchService's validateUrl() function allows unsafe hosts like 127.0.0.1 or localhost without proper IP range checks.

Impact Analysis

An attacker could exploit this to access internal services, scan internal networks, or interact with other systems on behalf of the server. This may lead to data leaks, unauthorized actions, or further exploitation of internal resources. The impact depends on what services are accessible from the server.

Compliance Impact

This SSRF vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems. For GDPR, it may lead to breaches of personal data. For HIPAA, it could expose protected health information. Organizations must address this to maintain compliance.

Mitigation Strategies

Update Pixelfed to the latest version where this issue is patched. Disable remote-search functionality if unused. Ensure ActivityPubFetchService's validateUrl() strictly blocks all private, internal, and link-local IP ranges (e.g., 169.254.0.0/16, 10.0.0.0/8). Enable and enforce DNS validation to filter by allowed domains only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart