CVE-2026-55160

high

Stringer is a self-hosted, anti-social RSS reader.

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup), even a low-privileged registered user can exploit this to scan internal services or steal cloud IAM credentials. This issue has been patched via commit 75cb095.

CVSS

7.6

7.6 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-09-28 18:17

Modified: 2026-09-30 19:57

NVD status: Deferred

Last synced 2 days ago

Verified against the source API 2026-10-27 06:56 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-918

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/stringer-rss/stringer/commit/75cb0955919a362ac49d23c8a14892d0f59ea1c4 security-advisories@github.com
https://github.com/stringer-rss/stringer/pull/1548 security-advisories@github.com
https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q security-advisories@github.com
https://github.com/stringer-rss/stringer/security/advisories/GHSA-496x-437q-h35q 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:56 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores