CVE-2026-25123 Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
Unauthenticated attackers can exploit an SSRF vulnerability in Homarr to perform server-side requests and port scans.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25123?
CVE-2026-25123 is a medium-severity server-side request forgery vulnerability in homarr-labs homarr, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-25123?
It affects 1 product.
Products include Homarr Homarr.
How do I fix CVE-2026-25123?
No fix has been published for CVE-2026-25123 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-25123 being exploited?
There is no known exploitation of CVE-2026-25123 in the wild and no public exploit code.
Other vulnerabilities in homarr-labs homarr
- CVE-2026-33510 DOM-Based XSS in Homarr /auth/login Redirect
- CVE-2025-64759 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload
- CVE-2025-67493 Homarr: missing input sanitization and possible privilege escalation through ldap search query injection
- CVE-2026-27796 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
- CVE-2026-27797 Homarr: Unauthenticated SSRF in rssFeed.ts
Sources
Also known as GHSA-c6rh-8wj4-gv74.