Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by… (CVE-2026-108735)
Description
Miniflux versions 2.3.0 through 2.3.3 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to set a feed's proxy_url to internal or loopback addresses. This bypasses network restrictions intended to prevent access to private networks, enabling potential probing of internal ports and proxy-style requests to internal services. The vulnerability has a medium severity with a CVSS score of 4.3.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Miniflux versions 2.3.0 through 2.3.3 contain a server-side request forgery vulnerability (CVE-2026-108735) where authenticated users can manipulate the proxy_url of a feed to access internal or loopback network addresses. This bypasses the FETCHER_ALLOW_PRIVATE_NETWORKS checks, allowing attackers to probe internal ports and send proxy requests to internal services, potentially exposing internal network resources.
Potential Impact
Authenticated users can exploit this vulnerability to bypass network access restrictions and reach internal or loopback addresses. This could allow attackers to probe internal network ports and interact with internal services through proxy-style requests, potentially exposing sensitive internal resources or information. The impact is limited to information disclosure with no direct integrity or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted users only and monitor for unusual proxy_url configurations. Avoid exposing Miniflux instances to untrusted networks or users.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f5cv-wgfv-h2x2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108735"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6acc009c2cdf04f656fe9d2a
Added to database: 10/11/2026, 21:33:16 UTC
Last enriched: 10/11/2026, 21:40:51 UTC
Last updated: 10/12/2026, 02:08:14 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.