Server-Side Request Forgery in LibreTV Affects User Data Security

CVE-2026-123207

What is CVE-2026-123207?

LibreTV versions prior to v2.21.2 are susceptible to a server-side request forgery vulnerability, which allows authenticated users to bypass the checkUpstreamAllowed() mechanisms. This exploitation can occur through unpinned DNS resolution utilized within fetchWithSafeRedirects(). Malicious actors with control over authoritative DNS can manipulate the resolution process, responding with public addresses during validation and later providing internal network locations when establishing connections. Such actions can lead to unauthorized access to local services, private hosts, or sensitive cloud metadata endpoints, posing significant risks to user data security and system integrity.

References