CVE-2026-71246: Pixelfed: Authenticated SSRF via Remote URL Search
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl() only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP against private, internal, or link-local ranges (e.g. 169.254.169.254). Optional DNS validation is disabled by default and, when enabled, only confirms a DNS record exists without filtering by IP range. The fetch response body is returned to the requester only when the Content-Type matches an ActivityPub content type, making this a semi-blind but authenticated SSRF primitive reachable by any logged-in user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Harden URL validation in ActivityPubFetchService::validateUrl() so it does not only block literal hosts (127.0.0.1, localhost, ::1) and requires https, but also blocks URLs whose resolved IP falls within private/internal/link-local ranges (e.g., 169.254.169.254).
Pixelfed SearchController / ActivityPubFetchService validateUrl() remote-search URL validation = Require resolved IP to be outside private, internal, and link-local ranges - Compensating control
Block outbound requests from Pixelfed to link-local and private/internal address ranges to mitigate SSRF to 169.254.169.254 (and other internal ranges).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71246?
The severity of CVE-2026-71246 is rated as medium with a score of 5.7.
How do I fix CVE-2026-71246?
To fix CVE-2026-71246, ensure that the URL validation in the SearchController is enhanced to block potentially dangerous hosts and perform rigorous IP checking.
What is the main risk associated with CVE-2026-71246?
The main risk associated with CVE-2026-71246 is the potential for authenticated SSRF attacks via the remote-search parameters.
Which service is affected by CVE-2026-71246?
CVE-2026-71246 affects the Pixelfed application, specifically the SearchController and its interaction with the ActivityPubFetchService.
When was CVE-2026-71246 published?
CVE-2026-71246 was published on August 5, 2026.