CVE-2026-71246
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254).
Risk Assessment
An attacker can exploit this vulnerability to perform SSRF attacks, accessing internal network resources such as cloud metadata, potentially leading to data leakage or privilege escalation.
Recommendation
Update Pixelfed to a version with IP validation fixes. If not possible, restrict access to the remote-search feature and apply additional network filters.
Other vulnerabilities in Pixelfed
See all- CVE-2026-93960Medium
Vulnerability in Pixelfed up to 0.12.11 affects the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php of the OAuth Scope Handler component. Manipulation of the ID argument leads to missing authentication. The attack can be remote, and the exploit is public. Upgrading to 0.12.10 is recommended (though description says 0.12.11, recommended is 0.12.10 – likely a typo).
- CVE-2026-86178Medium
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Original NVD description (English source)
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254).