CVE-2026-57575 Misskey: SSRF bypass in URL Preview
Remote attackers can bypass SSRF protections in Misskey's URL preview to trigger internal network requests, though data exfiltration is limited.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57575?
CVE-2026-57575 is a medium-severity server-side request forgery vulnerability in misskey-dev misskey, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-57575?
How do I fix CVE-2026-57575?
No fix has been published for CVE-2026-57575 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-57575 being exploited?
There is no known exploitation of CVE-2026-57575 in the wild and no public exploit code.
Sources
Also known as GHSA-jvcx-f39m-5xrj.