CVE-2026-107449: CWE-918 Server-Side Request Forgery (SSRF) in linuxserver Heimdall

linuxserver Heimdall through version 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to the ItemController. However, the enhanced-application test and live-stats requests are performed via SupportedApps::execute(), which uses a GuzzleHttp client lacking IP address restrictions. In some realistic deployments, the POST /test_config and GET /get_stats endpoints are accessible through CSRF, enabling an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports, including the metadata IP 169.254.169.254. This can leak a status/port oracle and partial response data, constituting a server-side request forgery vulnerability.

An unauthenticated attacker can exploit this SSRF vulnerability to make the Heimdall server send arbitrary HTTP requests to internal network hosts and ports. This may allow information disclosure through status or port oracles and partial response data. The CVSS score is 3.4 (low severity), reflecting limited confidentiality impact and the requirement for user interaction (UI:R) and high attack complexity (AC:H). There is no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoints (POST /test_config and GET /get_stats) to trusted users only and consider implementing network-level controls to prevent unauthorized internal requests. Additionally, mitigate CSRF risks by enforcing proper anti-CSRF protections on these endpoints.