CVE-2026-57566

Summary

The /api/opds/proxy endpoint in Readest before 0.11.10 allows unauthenticated server-side request forgery (SSRF) by accepting arbitrary URLs without scheme or host validation, enabling attackers to access internal services or cloud metadata.

Exploitability

Exploitation is trivial for remote attackers due to lack of authentication and minimal input validation; no special privileges or user interaction required.

Blast radius

On self-hosted deployments with internal network access (e.g., Docker, Node), attackers could retrieve sensitive internal data such as cloud metadata or responses from internal services; Cloudflare Workers deployments are partially mitigated due to built-in restrictions on private addresses but remain vulnerable to open proxy abuse.

Detection

Defenders should monitor for anomalous outbound HTTP requests from the application server to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), or link-local metadata endpoints in application or reverse-proxy logs.

Prioritized remediation

Upgrade to Readest version 0.11.10 or later, which fixes the SSRF vulnerability by implementing proper URL scheme and host validation, blocking internal/metadata endpoints, and revalidating redirects.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.