CVE-2026-123207 · Other
NO FIX YET · SEE WHAT TO DO
LibreTV before v2.21.2 has a server-side request forgery flaw: an authenticated user can make the server fetch internal addresses by using a DNS name that resolves to a public address during validation and an internal one at connection time. An attacker could reach loopback services, private hosts or cloud metadata endpoints through the proxy, search and detail APIs.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host LibreTV and let users log in to it are exposed, because the flaw needs an authenticated account and reaches the server's own network. Deployments that are not reachable by user accounts, or that restrict outbound network access from the app server, are less exposed. The sources do not say whether managed hosting is affected.
Not affected if auth-required, managed-hosting
Who cares cloud-metadata, libretv, self-hosted
v2.21.2 are in the stated range./api/source/test, /api/proxy, /api/search or /api/detail on your deployment.v2.21.2 or later.LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.