Server-Side Request Forgery in Wallos Personal Subscription Tracker

CVE-2026-33401

What is CVE-2026-33401?

The Wallos Personal Subscription Tracker, an open-source software, is affected by a Server-Side Request Forgery vulnerability prior to version 4.7.0. Despite previous patches aimed at notification test endpoints, the software left three vectors exposed: the AI Ollama host parameter, the AI recommendations endpoint, and the notification cron job. An authenticated user can exploit this vulnerability to craft malicious URLs that may allow access to internal network services, including potentially sensitive cloud metadata from platforms like AWS, GCP, and Azure, as well as localhost-bound services. This issue has been addressed and mitigated in version 4.7.0.

References