Read the docs
TI-2026-85586 Aliases CVE-2026-123207GHSA-55w8-f34c-fr45

Server-side request forgery in LibreTV via DNS rebinding

Priority LOW 12CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

LibreTV before v2.21.2 contains a server-side request forgery flaw in which unpinned DNS resolution lets the validation check be bypassed. An authenticated user who controls authoritative DNS can make the server reach loopback services, private hosts or cloud metadata endpoints through /api/source/test, /api/proxy, /api/search or /api/detail. The flaw is a time-of-check time-of-use race condition (CWE-367), where DNS returns a public address during validation and an internal address at connection time.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

Why it matters now

EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed LibreTV (LibreSpark): v2.21.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LibreSparkLibreTVbefore v2.21.2v2.21.2Patch availableCNA
  • LibreTV VendorLibreSpark Affected before v2.21.2 Fixed in v2.21.2 Patch available CNA

Remediation

Upgrade LibreSpark LibreTV to v2.21.2, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA LibreTV (LibreSpark) Fixed in v2.21.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123207
  2. 2026-11-05 Alias added: GHSA-55w8-f34c-fr45
  3. 2026-11-07 Affected versions changed · Red Hat
  4. 2026-11-07 CVSS score added · Red Hat

References

Patch 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences