CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
An attacker can exploit SSRF in changedetection.io to access internal network resources and exfiltrate sensitive data via watch URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27696?
CVE-2026-27696 is a high-severity server-side request forgery vulnerability in dgtlmoon changedetection.io, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-27696?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.54.1 |
changedetection-io PyPI | All versions | 0.54.1 |
changedetection-io PyPI | All versions | 0.54.1 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-27696?
Upgrade changedetection.io to 0.54.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-27696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27696 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
- CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
Sources
Also known as GHSA-3c45-4pj5-ch7m, PYSEC-2026-2126.