CVE-2026-55598: PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/addpodcast in rust-api/src/handlers/podcasts.rs. getpodcastvalues and addepisodes in rust-api/src/database.rs parse the feed with feed-rs and store the <enclosure url> verbatim in Episodes.episodeurl without destination host/IP validation. POST /api/data/downloadpodcast invokes spawndownloadpodcastepisode and downloadepisodeandwait() in rust-api/src/services/tasks.rs, which sends a reqwest GET to the stored URL and saves and records the response in DownloadedEpisodes for later retrieval. The estimatedurationfromaudiourlasync() path in rust-api/src/database.rs also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.
Event History
Frequently Asked Questions
Which users can trigger the server-side requests?
A low-privilege authenticated user can trigger them by subscribing to an attacker-controlled RSS feed and then using the podcast download functionality. No user interaction is required.
What systems can be reached from the vulnerable server?
The vulnerable server can send GET and HEAD requests to destinations it can reach, including loopback addresses, private-network services, and cloud metadata services. Redirects are followed by default, so an external URL can redirect to an internal destination.
Can an attacker retrieve data returned by an internal service?
Yes. Downloaded responses are saved and recorded for later retrieval, allowing an authenticated attacker to read internal responses obtained through the download path.
Which releases are affected?
PinePods releases prior to 0.9.0 are affected. The provided data does not describe a mitigation for deployments that cannot move to 0.9.0 or later.