CVE-2026-123207: LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

Published Nov 5, 2026

Updated

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated LibreTV account and control of authoritative DNS for a hostname. The attack relies on returning a public IP address during validation and an internal IP address when LibreTV connects.

What internal targets could be exposed?

The affected endpoints can be used to reach loopback services, private hosts, and cloud metadata endpoints from the LibreTV server. Exposure depends on what those targets are reachable from the server running LibreTV.

Which application functions are affected?

The issue is reachable through /api/source/test, /api/proxy, /api/search, and /api/detail. These routes use the vulnerable DNS handling in fetchWithSafeRedirects().

How can I tell whether my deployment is affected?

LibreTV versions before v2.21.2 are affected. Deployments that allow authenticated users to supply upstream hostnames through the affected API routes are exposed to this DNS rebinding bypass.

What should be done if an immediate upgrade is not possible?

Restrict or disable authenticated access to the affected API routes where feasible, and prevent the LibreTV server from reaching loopback, private-network, and cloud metadata addresses through network egress controls. This reduces the impact of requests redirected to internal addresses after DNS validation.

CVE-2026-123207: LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

Event History

Frequently Asked Questions

Who can exploit this issue?

What internal targets could be exposed?

Which application functions are affected?

How can I tell whether my deployment is affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What internal targets could be exposed?

Which application functions are affected?

How can I tell whether my deployment is affected?

What should be done if an immediate upgrade is not possible?