CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Authenticated users can exploit missing URL validation in Subsonic radio features to access internal network resources via Server-Side Request Forgery.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54493?
CVE-2026-54493 is a high-severity server-side request forgery vulnerability in koel, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API. app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php pass the stored URL through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php, where RadioStreamProxy::openStream() calls fopen($url, 'r', false, $context). Streaming /radio/stream/{id} returns the upstream response body, allowing access to loopback, RFC1918, Docker bridge, metadata, or other internal HTTP services reachable from the Koel server. This issue is fixed in version 9.7.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-54493?
2 open source packages ship an affected version, including phanan/koel.
| Package | Affected | Fixed in |
|---|---|---|
phanan/koel Packagist | All versions | 9.7.0 |
phanan/koel Packagist | All versions | 9.7.0 |
How do I fix CVE-2026-54493?
Upgrade phanan/koel to 9.7.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54493 exists.
Sources
Also known as GHSA-6p96-cfg5-4vhp.