CVE-2026-57566 in Readest
Summary
by MITRE • 11/04/2026
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Readest prior to version 0.11.10 constitutes a critical Server-Side Request Forgery (SSRF) and open proxy misconfiguration within the application's API layer. Specifically, the unauthenticated endpoint located at /api/opds/proxy was designed to facilitate access to Online Public Access Catalogs but suffered from insufficient input validation regarding the target URL scheme and destination host. The server-side implementation accepted attacker-controlled URLs without enforcing restrictions on private IP ranges, loopback addresses, link-local networks, or metadata service endpoints such as those found in cloud environments like AWS EC2 Instance Metadata Service (IMDS). Furthermore, the proxy logic failed to validate destinations during automatic HTTP redirect following, allowing attackers to bypass initial host checks by chaining redirects through intermediate servers that ultimately resolve to internal resources. This architectural flaw effectively transforms the application into an open request proxy, enabling remote actors to initiate requests from the server's network context rather than their own client environment.
The operational impact of this vulnerability is severe for deployments running on Node.js, Docker containers, or other self-hosted infrastructure with access to internal networks. An unauthenticated attacker can leverage this endpoint to perform port scanning, service enumeration, and data exfiltration from internal services that are not exposed to the public internet. In cloud-native environments, the ability to fetch responses from metadata endpoints poses a significant risk of credential theft or instance compromise if combined with other vulnerabilities. While Cloudflare Workers deployments inherently restrict access to link-local and private destinations due to platform-level security controls, thereby mitigating the internal-network impact in those specific contexts, the underlying flaw remains present. The unauthenticated public fetch-and-reflect behavior persists across all deployment types, meaning that even where direct network access is blocked, the application still processes malicious requests unnecessarily, increasing attack surface exposure and potential for abuse through other vectors such as denial of service via resource exhaustion or logging manipulation.
From a technical classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving improper restriction of a web server to internal resources during request processing. The lack of validation on the URL scheme and host falls under CWE-602 Client-Side Enforcement of Server-Side Security, as the application relied on external factors or incomplete checks rather than strict server-side policy enforcement. Additionally, the reflection of upstream status codes and response bodies contributes to information disclosure risks associated with CWE-209 Generation of Error Message Containing Sensitive Information. In terms of adversary tactics, this exploitation technique maps directly to ATT&CK T1571 Non-Standard Port as a means of bypassing network security controls, and potentially T1046 Network Service Discovery if used for internal reconnaissance. The ability to send arbitrary headers also introduces risks related to header injection or spoofing, which can be categorized under CWE-923 Improper Restriction of Excessive Authentication Requests if leading to brute-force attacks against internal services using the server's identity.
Mitigation strategies must prioritize immediate patching and architectural hardening. The primary remediation is upgrading Readest to version 0.11.10 or later, where these validation checks have been implemented. For organizations unable to upgrade immediately due to dependency constraints, network-level controls should be enforced via firewall rules or reverse proxy configurations that block outbound connections from the application server to private IP ranges and known metadata service endpoints such as 169.254.169.254 for AWS or similar addresses in other cloud providers. Input validation must also be strengthened at the API gateway level to reject requests containing suspicious URL schemes like file, gopher, or ftp if they are not explicitly required by business logic. Additionally, implementing strict allow-lists for permitted outbound destinations and disabling automatic redirect following unless absolutely necessary will significantly reduce the attack surface. Security monitoring should be enhanced to detect anomalous patterns of outbound traffic originating from the application server, particularly requests targeting internal subnets or metadata endpoints, which serve as strong indicators of active exploitation attempts.