Threat database

CVE-2026-55160 is a Server-Side Request Forgery (SSRF) vulnerability in the stringer-rss Stringer application, a self-hosted RSS reader. Before a specific patch commit, authenticated users could make the server send arbitrary HTTP/HTTPS requests to internal networks, localhost, and cloud metadata endpoints such as AWS IMDS. This vulnerability allows low-privileged users, especially when self-service signup is enabled, to scan internal services or potentially steal cloud IAM credentials. The issue has been patched in commit 75cb095.