CVE-2026-108735 in Miniflux
Summary
by MITRE • 10/11/2026
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The Miniflux application, specifically versions 2.3.0 through 2.3.3, contains a critical server-side request forgery vulnerability that stems from insufficient validation of user-supplied input within the feed configuration parameters. This flaw allows authenticated users to manipulate the proxy_url field associated with their feeds in order to redirect outbound network requests toward internal or loopback addresses. The core technical issue lies in the application's failure to properly sanitize and validate the target host before initiating an HTTP request, thereby enabling attackers to bypass intended security controls designed to restrict access to private networks.
The operational impact of this vulnerability is significant as it allows authenticated users to probe internal network infrastructure and interact with services that are typically inaccessible from external environments. By setting the proxy_url parameter to point at loopback addresses such as 127.0.0.1 or other internal IP ranges, an attacker can effectively use Miniflux as a pivot point for further reconnaissance against backend systems. This capability facilitates port scanning and service enumeration within the local network segment where Miniflux is deployed, potentially exposing sensitive applications like databases, administrative panels, or microservices that rely on implicit trust in their accessibility from application servers.
This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws allowing an attacker to cause the server to make requests to arbitrary destinations. Furthermore, it maps to MITRE ATT&CK technique T1571 Proxy Discovery and T1046 Network Service Scanning, as the exploitation involves using a trusted application to discover internal network services and map out potential attack surfaces within the organization's infrastructure. The bypass of FETCHER_ALLOW_PRIVATE_NETWORKS checks indicates that while some level of restriction was intended by developers, it can be circumvented through specific manipulation of the proxy configuration rather than direct URL injection in standard fetch operations.
Mitigation strategies should focus on implementing strict allow-listing for permitted hostnames and IP addresses when processing feed URLs or proxy configurations. Developers must ensure that any user-controlled input used to construct network requests undergoes rigorous validation against a predefined list of safe domains, rejecting all other inputs outright rather than relying solely on blocklists which can be easily bypassed using alternative protocols or encoding techniques. Additionally, enforcing the principle of least privilege for application service accounts and isolating Miniflux within its own network segment with restrictive firewall rules can limit the blast radius if such a vulnerability is exploited in production environments.