CVE-2026-27797 Homarr: Unauthenticated SSRF in rssFeed.ts

What is CVE-2026-27797?

CVE-2026-27797 is a medium-severity server-side request forgery vulnerability in homarr-labs homarr, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.

Weakness: CWE-918

Which versions are affected by CVE-2026-27797?

It affects 1 product.

Products include Homarr Homarr.

How do I fix CVE-2026-27797?

No fix has been published for CVE-2026-27797 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-27797 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27797 exists.

Other vulnerabilities in homarr-labs homarr

• CVE-2026-33510 DOM-Based XSS in Homarr /auth/login Redirect High 8.8
• CVE-2025-64759 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload High 8.1
• CVE-2025-67493 Homarr: missing input sanitization and possible privilege escalation through ldap search query injection High 7.5
• CVE-2026-27796 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) Medium 5.3
• CVE-2026-25123 Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vwqf-2f4m-2cq2.