Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through… (CVE-2026-71246)
Pixelfed's SearchController accepts a URL parameter for remote searching and fetches it server-side via ActivityPubFetchService. The service's URL validation only blocks localhost addresses and requires HTTPS but does not check if the resolved IP is within private or internal ranges. DNS validation is optional and does not filter IP ranges. The fetched response body is returned to authenticated users only if the content type matches ActivityPub types, resulting in a semi-blind SSRF vulnerability accessible to logged-in users.
AI Analysis
Technical Summary
Pixelfed's SearchController, protected by authentication middleware, processes a remote-search URL parameter that it fetches server-side using ActivityPubFetchService. The validateUrl() method blocks only literal localhost IPs (127.0.0.1, localhost, ::1) and enforces HTTPS but does not verify whether the resolved IP address belongs to private, internal, or link-local ranges such as 169.254.169.254. DNS validation, which is disabled by default, only confirms the existence of a DNS record without filtering IP ranges. The server returns the fetched response body to the requester only if the Content-Type matches an ActivityPub content type. This creates a semi-blind Server-Side Request Forgery (SSRF) vulnerability that any authenticated user can exploit.
Potential Impact
An authenticated user can exploit this SSRF vulnerability to make the Pixelfed server perform arbitrary HTTPS requests to internal or private IP addresses that are normally inaccessible externally. The returned response body is limited to ActivityPub content types, making the attack semi-blind. The vulnerability does not allow direct impact on integrity or availability but can lead to information disclosure of internal resources accessible to the server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SearchController to trusted users only and monitor for unusual internal requests. Consider implementing additional server-side validation to block requests to private, internal, or link-local IP ranges and enable strict DNS validation filtering IP ranges.
Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through… (CVE-2026-71246)
Description
Pixelfed's SearchController accepts a URL parameter for remote searching and fetches it server-side via ActivityPubFetchService. The service's URL validation only blocks localhost addresses and requires HTTPS but does not check if the resolved IP is within private or internal ranges. DNS validation is optional and does not filter IP ranges. The fetched response body is returned to authenticated users only if the content type matches ActivityPub types, resulting in a semi-blind SSRF vulnerability accessible to logged-in users.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Pixelfed's SearchController, protected by authentication middleware, processes a remote-search URL parameter that it fetches server-side using ActivityPubFetchService. The validateUrl() method blocks only literal localhost IPs (127.0.0.1, localhost, ::1) and enforces HTTPS but does not verify whether the resolved IP address belongs to private, internal, or link-local ranges such as 169.254.169.254. DNS validation, which is disabled by default, only confirms the existence of a DNS record without filtering IP ranges. The server returns the fetched response body to the requester only if the Content-Type matches an ActivityPub content type. This creates a semi-blind Server-Side Request Forgery (SSRF) vulnerability that any authenticated user can exploit.
Potential Impact
An authenticated user can exploit this SSRF vulnerability to make the Pixelfed server perform arbitrary HTTPS requests to internal or private IP addresses that are normally inaccessible externally. The returned response body is limited to ActivityPub content types, making the attack semi-blind. The vulnerability does not allow direct impact on integrity or availability but can lead to information disclosure of internal resources accessible to the server.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SearchController to trusted users only and monitor for unusual internal requests. Consider implementing additional server-side validation to block requests to private, internal, or link-local IP ranges and enable strict DNS validation filtering IP ranges.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5cfc-gvxj-5r55
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-71246"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a73574abf8831d53915a2bb
Added to database: 08/05/2026, 15:31:22 UTC
Last enriched: 08/05/2026, 17:43:58 UTC
Last updated: 09/19/2026, 22:01:37 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.