CVE-2026-42346 Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Attackers can bypass SSRF protections via DNS rebinding to access internal network resources in Postiz.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42346?
CVE-2026-42346 is a medium-severity server-side request forgery vulnerability in gitroomhq postiz-app, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
Weakness: CWE-918
Which versions are affected by CVE-2026-42346?
How do I fix CVE-2026-42346?
No fix has been published for CVE-2026-42346 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42346 being exploited?
There is no known exploitation of CVE-2026-42346 in the wild and no public exploit code.
Sources
Also known as GHSA-f7jj-p389-4w45.