CVE-2026-107449

LowCVSS 3.4/10Last modified Oct 8, 2026

Description

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
linuxserverHeimdall<= 2.8.3

References

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-107457.9Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log InjectioCVE-2026-1074505.4In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only CVE-2026-1074572.3A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client anCVE-2026-1074599.8The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS CVE-2026-1074609.1Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating cCVE-2026-1074666.1A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuouCVE-2026-1074710.0IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overfCVE-2026-1074724.3An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impCVE-2026-1074746.5The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credeCVE-2026-1074791.7An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt FramewoCVE-2026-107487.2An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating systCVE-2026-1074847.3An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to