CVE-2026-42346: Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Postizto a version that resolves this vulnerability.Fixed in 2.21.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42346?
CVE-2026-42346 is considered a high severity vulnerability due to its potential to bypass SSRF protections.
How do I fix CVE-2026-42346?
To fix CVE-2026-42346, upgrade Postiz to version 2.21.7 or later.
Which versions of Postiz are affected by CVE-2026-42346?
Versions of Postiz from 2.16.6 to before 2.21.7 are affected by CVE-2026-42346.
What type of vulnerability is CVE-2026-42346?
CVE-2026-42346 is a TOCTOU vulnerability that affects the safety of URL validations.
What is the risk associated with CVE-2026-42346?
The risk associated with CVE-2026-42346 includes unauthorized access and data exfiltration through SSRF attacks.