CVE-2026-55160: Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Published Sep 28, 2026

Updated

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup), even a low-privileged registered user can exploit this to scan internal services or steal cloud IAM credentials. This issue has been patched via commit 75cb095.

Affected Software

1 affected component

Stringer Stringer

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Stringer to a version that resolves this vulnerability.
Patch 75cb095

Event History

Sep 28, 2026

CVE Published

via MITRE·05:52 PM

Data Sourced

via MITRE·05:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

Any authenticated Stringer user can exploit it. If self-service signup is enabled through Setting::UserSignup, a newly registered low-privileged user is sufficient.

What access does an attacker need, and what can they reach?

The attacker needs an authenticated account and can cause the Stringer server to make arbitrary HTTP or HTTPS requests. This can target internal networks, localhost-only services, and cloud metadata endpoints such as AWS IMDS at 169.254.169.254.

Is there a fix available?

Yes. The issue is patched by commit 75cb0955919a362ac49d23c8a14892d0f59ea1c4.