Bug 2567581 (CVE-2026-123207) - CVE-2026-123207 libretv: LibreTV: Server-Side Request Forgery via unpinned DNS resolution
Summary: CVE-2026-123207 libretv: LibreTV: Server-Side Request Forgery via unpinned DN...
Keywords:
Status: NEW
Alias: CVE-2026-123207
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-05 22:09 UTC by OSIDB Bzimport
Modified: 2026-11-05 23:28 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-05 22:09:35 UTC 
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
Note You need to log in before you can comment on or make changes to this bug.