CVE-2026-56771 is an SSRF vulnerability in samuelclay NewsBlur before version 14.5.0. The issue exists in the add_url endpoint, where insufficient filtering of private IP addresses allows authenticated users to craft server-side requests to internal network resources. This can expose localhost services and cloud metadata endpoints to unauthorized access, facilitating internal network scanning and exfiltration of sensitive information. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.3. No vendor advisory or patch information is currently available.

Authenticated attackers can exploit this SSRF vulnerability to make arbitrary requests from the NewsBlur server to internal network addresses, including localhost and cloud metadata endpoints. This can lead to unauthorized internal network reconnaissance and potential exfiltration of sensitive data accessible from these internal services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted parties only and monitor for suspicious activity related to the add_url endpoint. Avoid exposing sensitive internal services that could be accessed via SSRF.