Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107449

Quick assessment

Affected
linuxserver Heimdall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LinuxServer Heimdall 2.8.3 及之前版本中，其 SafeUrlFetcher SSRF 防护机制仅应用于 ItemController；而增强型应用程序测试和实时统计请求则通过 SupportedApps::execute() 发起，该方法使用 GuzzleHttp 客户端，且缺乏 IP 地址限制。在部分实际部署环境中，POST /test_config 和 GET /get_stats 接口可能因 CSRF 漏洞被间接利用，从而导致未认证的攻击者能够强制服务器向任意内部主机和端口（包括 1

CVSS 3.4 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107449

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
linuxserver Heimdall 0 ~ 2.8.3 -

II. Public POCs for CVE-2026-107449

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107449

请登录查看更多情报信息。

Other References for CVE-2026-107449 (2)

IV. Related Vulnerabilities

Same product: Heimdall
Same vendor: linuxserver
Same weakness: CWE-918

V. Comments for CVE-2026-107449

No comments yet

Leave a comment