CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
Authenticated users can exploit a proxy URL setting to access internal network resources, bypassing private network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108735?
CVE-2026-108735 is a medium-severity server-side request forgery vulnerability in miniflux, published on 11 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
Weakness: CWE-918
Which versions are affected by CVE-2026-108735?
How do I fix CVE-2026-108735?
No fix has been published for CVE-2026-108735 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-108735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108735 exists.
Sources
Also known as DEBIAN-CVE-2026-108735, GHSA-f5cv-wgfv-h2x2, UBUNTU-CVE-2026-108735.