Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42346Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Medium 6.5

In plain English

A medium-severity server-side request forgery in postiz-app from gitroomhq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 86.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

Affected products (as reported)

Vendor	Product	Versions
gitroomhq	postiz-app	>= 2.16.6, < 2.21.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45 x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb x_refsource_MISC
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 x_refsource_MISC