CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image
An authenticated user can trigger server-side requests to internal endpoints via unvalidated Open Graph image URLs, exposing internal data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42181?
CVE-2026-42181 is a medium-severity server-side request forgery vulnerability in LemmyNet lemmy, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.
Weakness: CWE-918
Which versions are affected by CVE-2026-42181?
2 open source packages ship an affected version, including lemmy_api_common.
| Package | Affected | Fixed in |
|---|---|---|
lemmy_api_common crates.io | All versions | 0.19.18 |
lemmy_api_common crates.io | All versions | 0.19.18 |
How do I fix CVE-2026-42181?
Upgrade lemmy_api_common to 0.19.18 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42181 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42181 exists.
Sources
Also known as GHSA-h6hf-9846-xwrq.