CVE-2026-54494
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Koel before version 9.7.1 incorrectly treats NAT64 and 6to4 addresses as public, allowing an authenticated user to place such an address in a podcast RSS and trigger requests to internal services or cloud metadata. The response body is returned to the user.
Risk Assessment
An attacker can access internal resources or sensitive data (e.g., cloud metadata), potentially leading to privilege escalation or data leakage.
Recommendation
Update Koel to version 9.7.1, which fixes the address validation in isPublicHost().
Other vulnerabilities in Koel
See all- CVE-2026-54493High
In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.
- CVE-2026-54492Medium
Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.
- CVE-2026-54491High
In Koel before 9.7.1, outbound podcast and radio fetch paths perform a point-in-time isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation. This allows following an attacker-controlled redirect to an internal address or connecting after DNS rebinding. These paths are reachable through podcast and radio APIs, allowing an authenticated user to access internal services or cloud metadata.
- CVE-2026-50552Medium
Koel is a free, open-source music streaming solution. Prior to version 9.7.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint, allowing the server to be coerced into making requests to arbitrary internal hosts.
- CVE-2026-47260High
Koel is a free, open-source music streaming solution. In versions prior to 9.3.5, Koel did not properly validate podcast episode URLs, allowing for SSRF attacks against internal services.
Original NVD description (English source)
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An authenticated user can place such an address in a podcast RSS <enclosure url> and reach app/Values/Podcast/EpisodePlayable.php through EpisodePlayable::createForEpisode(), where isSafeUrl() accepts the target and Http::sink($file)->get($url) fetches it. On a host with NAT64 or 6to4 routing, Koel can request internal services or cloud metadata and return the response body to the user. This issue is fixed in version 9.7.1
Vulnerability data from NVD (NIST) · CISA KEV · EPSS