CVE-2026-55598

9.1 CRITICALpublic exploit available

Published 2026-10-30 · Updated 2026-10-30

AI risk analysis

Summary: An authenticated low-privilege user can subscribe to a malicious RSS feed that causes the PinePods server to make unvalidated HTTP requests to internal or metadata endpoints via enclosure URLs, including redirects, allowing read access to internal services and sensitive data like cloud credentials.
Exploitability: Exploitation requires valid authentication and server-side download enabled (default), but no elevated privileges; attackers can craft malicious RSS feeds with external enclosure URLs that redirect to internal targets.
Blast radius: An attacker can enumerate internal services, exfiltrate metadata service credentials (e.g., AWS, Azure, GCP), and access any reachable internal HTTP endpoint the server can reach, potentially compromising the entire internal network or cloud environment.
Detection: Monitor for unexpected outbound HTTP/HTTPS requests from the PinePods server to internal IP ranges (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), cloud metadata endpoints (e.g., 169.254.169.254), or non-public FQDNs in server logs; also watch for repeated HEAD requests to newly added podcast enclosure URLs.
Prioritized remediation: Upgrade to PinePods version 0.9.0 or later, which validates destination hosts/IPs before making requests to enclosure URLs.

ssrfinternal-enumerationcloud-metadata-accessrss-parsingunvalidated-redirect

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Weaknesses

CWE-918

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.