The vulnerability identified as CVE-2026-55160 in stringer-rss is an SSRF flaw that permits authenticated users to coerce the server into making arbitrary HTTP/HTTPS requests to internal resources, including localhost and cloud metadata services like AWS IMDS at 169.254.169.254. This can lead to unauthorized access to internal network services and cloud credentials. The vulnerability existed prior to commit 75cb095, which introduced a patch to prevent such exploitation. The vulnerability has a CVSS 3.1 score of 7.6, indicating high severity, with attack vector network, low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability.

Exploitation of this SSRF vulnerability can lead to unauthorized internal network scanning and access to sensitive internal services. Additionally, attackers can retrieve cloud IAM credentials from metadata endpoints, potentially leading to further compromise of cloud resources. The impact includes high confidentiality loss, limited integrity impact, and limited availability impact.

An official patch addressing this SSRF vulnerability is available and was introduced in commit 75cb095. Users of stringer-rss should apply this patch promptly to remediate the issue. Since this is a self-hosted service, administrators must update their deployments accordingly. No additional mitigation is required beyond applying the official fix.