Bug 2567581 (CVE-2026-123207)

Summary: CVE-2026-123207 libretv: LibreTV: Server-Side Request Forgery via unpinned DNS resolution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in LibreTV. This flaw allows an authenticated remote attacker to bypass Server-Side Request Forgery (SSRF) protections, potentially leading to unauthorized access to internal services or information disclosure. By exploiting unpinned Domain Name System (DNS) resolution, an attacker controlling an external DNS server can return an allowed public address during initial validation and an internal address when the connection is established. As a result, the attacker can force the server to send unauthorized requests to internal hosts, loopback services, or cloud metadata endpoints.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:09:35 UTC 
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.