In glean versions before 0.2.6, the POST /api/feeds/discover endpoint accepts a feed_url parameter that is passed to discover_feed(feed_url), which creates a subscription and enqueues a background task to fetch and parse the feed. The background task fetches URLs from feed entries without network-level validation, allowing an attacker to supply malicious feed URLs that cause the server to request internal, loopback, link-local, or cloud metadata resources. The fetched content is stored and can be retrieved via GET /api/entries/{id}, resulting in non-blind SSRF with full response disclosure. This vulnerability can bypass network perimeters and expose sensitive internal or cloud metadata information. The vulnerability is addressed in version 0.2.6.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal network resources, including private, loopback, link-local, or cloud metadata endpoints. This can lead to disclosure of sensitive internal configuration, web content, or cloud metadata access tokens. The vulnerability allows full response disclosure, increasing the risk of information leakage. There is no indication of integrity or availability impact. The CVSS score is 7.7 (high severity).

This vulnerability is fixed in glean version 0.2.6. Users should upgrade to version 0.2.6 or later to remediate this issue. No additional mitigation is required once the upgrade is applied.