CVE-2026-123207— LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

Quick assessment

Affected

LibreSpark LibreTV

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

v2.21.2 之前的 LibreTV 版本存在服务器端请求伪造（SSRF）漏洞。已认证用户可利用函数中未固定（unpinned）的 DNS 解析机制，绕过检查。攻击者若控制权威 DNS 服务器，可在验证阶段返回公网地址，而在实际连接时通过、、或接口返回内网地址，从而访问回环服务、私有主机或云元数据端点。

CVSS 3.1 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
LibreSpark	LibreTV	`< v2.21.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

Source: CVE Program / CVE List V5

Vulnerability Description

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

检查时间与使用时间(TOCTOU)的竞争条件

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
LibreSpark	LibreTV	0 ~ v2.21.2	-

II. Public POCs for CVE-2026-123207

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123207

请登录查看更多情报信息。

Other References for CVE-2026-123207 (6)

https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85 technical-description
https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1 patch
https://github.com/LibreSpark/LibreTV/pull/960 patch issue-tracking
https://github.com/LibreSpark/LibreTV/issues/941 issue-tracking
https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2 release-notes
https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123207

IV. Related Vulnerabilities

Same weakness: CWE-367