Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-55598: PinePods lets logged-in users retrieve internal network data
CVE-2026-55598 · published 5 days ago
Summary
In PinePods versions before 0.9.0, a user who can log in can add a podcast that points to any web address. The system then fetches that address from the server without checking where it leads, allowing it to contact internal services, cloud metadata endpoints, or other private resources and expose their responses. Upgrade to version 0.9.0 or later, or disable automatic podcast downloading, to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| madeofpendletonwool | pinepods | < 0.9.0 |
Original advisory text
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.
References
- https://github.com/madeofpendletonwool/PinePods/security/advisories/GHSA-j876-22... Vendor Advisory
- https://github.com/madeofpendletonwool/PinePods/commit/34843d37168c37bbf23ed6dbb... Patch
- https://github.com/madeofpendletonwool/PinePods/tree/0.9.0 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55598... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55598 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published30 Oct 2026
Updated4 Nov 2026
First seen30 Oct 2026
Track software like this
Free during beta