CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
An authenticated user can exploit the media proxy to perform Server-Side Request Forgery, accessing internal network resources and metadata endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21885?
CVE-2026-21885 is a medium-severity server-side request forgery vulnerability in miniflux v2, published on 8 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-21885?
4 open source packages ship an affected version, including miniflux.app/v2 and miniflux.app. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
miniflux.app/v2 Go | All versions | 2.2.16 |
miniflux.app/v2 Go | All versions | 2.2.16 |
miniflux.app/v2 Go | All versions | 2.2.16 |
miniflux.app Go | All versions | None |
Products include Miniflux Project Miniflux.
How do I fix CVE-2026-21885?
Upgrade miniflux.app/v2 to 2.2.16 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-21885 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21885 exists.
Other vulnerabilities in miniflux v2
- CVE-2023-27591 Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
- CVE-2025-67713 Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
- CVE-2023-27592 Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Sources
Also known as DEBIAN-CVE-2026-21885, GHSA-xwh2-742g-w3wp, GO-2026-4287, UBUNTU-CVE-2026-21885.