CVE-2026-54491
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In Koel before 9.7.1, outbound podcast and radio fetch paths perform a point-in-time isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation. This allows following an attacker-controlled redirect to an internal address or connecting after DNS rebinding. These paths are reachable through podcast and radio APIs, allowing an authenticated user to access internal services or cloud metadata.
Risk Assessment
The risk includes access to internal network resources and cloud metadata, potentially leading to sensitive information disclosure and infrastructure compromise.
Recommendation
Upgrade Koel to version 9.7.1 or later. Also implement validation of every redirect hop and pin addresses after verification.
Other vulnerabilities in Koel
See all- CVE-2026-54494Medium
Koel before version 9.7.1 incorrectly treats NAT64 and 6to4 addresses as public, allowing an authenticated user to place such an address in a podcast RSS and trigger requests to internal services or cloud metadata. The response body is returned to the user.
- CVE-2026-54493High
In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.
- CVE-2026-54492Medium
Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.
- CVE-2026-50552Medium
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint, allowing the server to be coerced into making requests to arbitrary internal hosts.
- CVE-2026-47260High
Koel is a free, open-source music streaming solution. In versions prior to 9.3.5, Koel did not properly validate podcast episode URLs, allowing for SSRF attacks against internal services.
Original NVD description (English source)
Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every redirect target. PhanAn\Poddle\Poddle::fromUrl(), PodcastService::getStreamableUrl(), PodcastService::isPodcastObsolete(), App\Rules\HasAudioContentType, and App\Rules\SafeUrl can therefore follow an attacker-controlled redirect to an internal address or connect after DNS rebinding changes a public resolution to a private one. These paths are reachable through podcast and radio APIs, including createPodcastChannel, createInternetRadioStation, refreshPodcasts, apiResource podcasts, and radio/stations, allowing an authenticated user to request internal services or cloud metadata and potentially receive parsed or streamed response content. This issue is fixed in version 9.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS