CVE-2026-57575: Misskey: SSRF bypass in URL Preview
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Misskeyto a version that resolves this vulnerability.Fixed in 2026.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57575?
CVE-2026-57575 has a medium severity rating of 6.9 according to the CVSS.
How do I fix CVE-2026-57575?
To fix CVE-2026-57575, upgrade your Misskey installation to version 2026.6.0 or later.
What type of vulnerability is CVE-2026-57575?
CVE-2026-57575 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What is affected by CVE-2026-57575?
CVE-2026-57575 affects the URL preview functionality in the Misskey platform prior to version 2026.6.0.
Can a remote attacker exploit CVE-2026-57575?
Yes, a remote attacker can exploit CVE-2026-57575 due to missing network restrictions before establishing outbound connections.