CVE-2026-56771 describes an SSRF vulnerability in samuelclay's NewsBlur product affecting versions before 14.5.0. The vulnerability exists in the add_url endpoint, which fails to properly filter requests to private IP ranges, allowing authenticated users to make arbitrary server-side requests to internal network addresses. This can be exploited to access localhost services and cloud metadata endpoints, facilitating internal network scanning and potential data exfiltration. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and limited impact on confidentiality and integrity but high scope change.

An authenticated attacker can leverage this SSRF vulnerability to send crafted requests from the NewsBlur server to internal network resources, including localhost and cloud metadata services. This can lead to unauthorized internal network reconnaissance and possible exposure of sensitive information accessible only from within the network. The vulnerability does not require user interaction and has a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted parties only and monitor for suspicious activity related to the add_url endpoint. Avoid exposing sensitive internal services that could be accessed via SSRF.