CVE-2026-77066
Received Received - Intake

Remote Code Execution via Unvalidated URL in API Resolver

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77066
EUVD
EUVD-2026-63255

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
omnivore-app omnivore *
omnivore-app omnivore to c4d7d8562e6b9aabb1d8e4dabca268e314baa43a (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Omnivore application. An authenticated user can send a malicious URL to the scanFeeds resolver, which then makes an HTTP request to that URL without validating if it points to a private or internal network. The server only returns limited metadata from feed-shaped responses or HTML links, but error messages may reveal reachable ports.

Detection Guidance

Detecting this SSRF vulnerability requires checking if the Omnivore application is running a vulnerable version without URL validation. Inspect the scanFeeds resolver in packages/api/src/resolvers/subscriptions/index.ts for direct axios.get(url) calls without validateUrl(). Test by sending requests to internal endpoints like http://127.0.0.1 or http://localhost and verify if the server processes them.

Impact Analysis

An attacker could exploit this to force the server to interact with internal or restricted network resources. While direct data exposure is limited, the server may reveal which ports are accessible through error responses. This could aid further attacks or reconnaissance of internal systems.

Compliance Impact

This SSRF vulnerability could potentially violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to internal systems or sensitive data through server-side requests. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The flaw allows attackers to probe internal networks, which may expose such data.

Mitigation Strategies

Apply the patch from commit c4d7d8562e6b9aabb1d8e4dabca268e314baa43a by adding validateUrl() checks in the scanFeeds resolver before axios.get() calls. Ensure the private-ip library is used to block private and reserved IP ranges. Update to the latest version of Omnivore and test that internal requests are rejected with BAD_REQUEST errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart