Vulnerability · Published Sep 28, 2026 · Assigned by GitHub_M

CVE-2026-55160Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

High 7.6

In plain English

A high-severity server-side request forgery in stringer from stringer-rss. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup), even a low-privileged registered user can exploit this to scan internal services or steal cloud IAM credentials. This issue has been patched via commit 75cb095.

Affected products (as reported)

Vendor	Product	Versions
stringer-rss	stringer	< 75cb0955919a362ac49d23c8a14892d0f59ea1c4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q x_refsource_CONFIRM
https://github.com/stringer-rss/stringer/pull/1548 x_refsource_MISC
https://github.com/stringer-rss/stringer/commit/75cb0955919a362ac49d23c8a14892d0f59ea1c4 x_refsource_MISC