Time-of-Check-Time-of-Use Vulnerability in Postiz AI Social Media Scheduling Tool

CVE-2026-42346

What is CVE-2026-42346?

Postiz, an AI-powered social media scheduling tool, has a vulnerability related to its SSRF protections. In versions ranging from 2.16.6 up to and including 2.21.6, an attacker could potentially exploit a Time-of-Check-Time-of-Use (TOCTOU) flaw within the isSafePublicHttpsUrl() function. While the function performs DNS resolution to verify the target IP, subsequent fetch() calls execute independent DNS resolutions. This discrepancy allows a malicious actor controlling a DNS server to conduct DNS rebinding attacks, which could redirect requests intended for external addresses to internal network locations. This vulnerability has been addressed in version 2.21.7, demonstrating the importance of timely updates to maintain security.

References