CVE-2026-18736 in Shlink
Summary
by MITRE • 08/04/2026
Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in Shlink represents a critical server-side request forgery flaw that fundamentally undermines the application's security boundaries and trust model. This issue affects authenticated API key holders who can exploit the system's title auto-resolution feature during short URL creation processes, creating a pathway for unauthorized information disclosure through crafted HTTP requests. The vulnerability specifically manifests when the system attempts to resolve the title of a long URL by fetching its HTML content, which enables attackers to manipulate this process into making arbitrary outbound connections that bypass normal network security controls.
The technical exploitation mechanism relies on the application's behavior of following redirects and retrieving HTML content from external sources without proper validation or sanitization of the target URLs. When an attacker submits a malicious URL that points to a public host configured to redirect to internal targets such as loopback addresses, link-local ranges, or cloud metadata endpoints like 169.254.169.254, the system follows these redirects and retrieves content from internal resources. This process occurs with the server's credentials and permissions, effectively allowing attackers to probe internal network services and extract sensitive information such as service versions, configuration details, or metadata that would normally be protected by network segmentation.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable further exploitation within the compromised environment. Attackers can leverage this capability to perform reconnaissance activities against internal systems, identify running services, discover vulnerable components, and gather intelligence for subsequent attacks. The cloud metadata endpoint 169.254.169.254 serves as a particularly dangerous target because it provides access to instance metadata that often includes security credentials, network configuration details, and other sensitive information that could be used for privilege escalation or lateral movement within the infrastructure.
This vulnerability aligns with CWE-918 which specifically addresses server-side request forgery vulnerabilities, and maps to attack techniques in the ATT&CK framework under T1046 for Network Service Scanning and T1566 for Phishing with Malicious Attachments. The flaw demonstrates how seemingly benign features like auto-resolution can become security risks when proper input validation and outbound connection restrictions are not implemented. Security professionals should recognize this as a classic example of insufficient validation of redirects and forwardings, where the application's trust model extends beyond its intended boundaries without adequate security controls to prevent unauthorized access to internal resources.
Mitigation strategies must focus on implementing strict URL validation and outbound connection restrictions that prevent the system from making requests to internal network ranges or sensitive endpoints. Organizations should disable or configure title auto-resolution features to operate within safe boundaries, implement proper network segmentation between application servers and internal resources, and deploy monitoring solutions to detect anomalous outbound traffic patterns. Additionally, developers should ensure that all external HTTP requests are properly sanitized, validated, and restricted to known good domains while implementing rate limiting and connection timeouts to prevent abuse of the feature. The vulnerability highlights the importance of defense in depth principles where multiple security controls work together to protect against similar classes of attacks that exploit trust relationships within applications.