CVE-2026-26379 describes an SSRF vulnerability in Koha's Z39.50/SRU server configuration affecting versions up to and including 25.11. Authenticated attackers can exploit this flaw to conduct internal network reconnaissance by sending crafted requests that cause the server to make requests to internal resources. The attack leverages differences in server response times to identify active services within the internal network. The vulnerability is classified under CWE-918 (Server-Side Request Forgery). No vendor advisory or patch information is available at this time.

An authenticated attacker can exploit this SSRF vulnerability to scan the internal network behind the Koha server and identify running services. This can lead to further targeted attacks or information disclosure within the internal network. The vulnerability has a medium severity impact with limited confidentiality and integrity impact and no availability impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Z39.50/SRU server configuration to trusted users only and monitor for suspicious authenticated activity that may indicate exploitation attempts.