CVE-2026-54493
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.
Risk Assessment
The risk is that the Koel server can be used to probe internal networks and access sensitive services, including cloud metadata, potentially leading to data leakage.
Recommendation
Upgrade Koel to version 9.7.0 or later. Also restrict API access and apply proper URL validation filters.
Other vulnerabilities in Koel
See all- CVE-2026-54494Medium
Koel before version 9.7.1 incorrectly treats NAT64 and 6to4 addresses as public, allowing an authenticated user to place such an address in a podcast RSS and trigger requests to internal services or cloud metadata. The response body is returned to the user.
- CVE-2026-54492Medium
Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.
- CVE-2026-54491High
In Koel before 9.7.1, outbound podcast and radio fetch paths perform a point-in-time isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation. This allows following an attacker-controlled redirect to an internal address or connecting after DNS rebinding. These paths are reachable through podcast and radio APIs, allowing an authenticated user to access internal services or cloud metadata.
- CVE-2026-50552Medium
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint, allowing the server to be coerced into making requests to arbitrary internal hosts.
- CVE-2026-47260High
Koel is a free, open-source music streaming solution. In versions prior to 9.3.5, Koel did not properly validate podcast episode URLs, allowing for SSRF attacks against internal services.
Original NVD description (English source)
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS