Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-77066Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

Medium 5.0

In plain English

A medium-severity server-side request forgery in omnivore from omnivore-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

Affected products (as reported)

Vendor	Product	Versions
omnivore-app	omnivore	0 – before c4d7d8562e6b9aabb1d8e4dabca268e314baa43a

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

GitHub Issue #4647 issue-tracking
fix(): fix ssrf via scan feeds and webhooks (#4656) patch
Unvalidated axios.get in scanFeedsResolver before the fix technical-description
https://github.com/omnivore-app/omnivore product
VulnCheck Advisory: Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query third-party-advisory