{"id":"CVE-2026-123207","kind":"vulnerability","aliases":["CVE-2026-123207"],"related":[],"title":"LibreTV: authenticated users can reach internal hosts via DNS rebinding","description":"LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.","summary":"LibreTV before v2.21.2 has a server-side request forgery flaw: an authenticated user can make the server fetch internal addresses by using a DNS name that resolves to a public address during validation and an internal one at connection time. An attacker could reach loopback services, private hosts or cloud metadata endpoints through the proxy, search and detail APIs.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-metadata","libretv","other","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the LibreTV version in the deployed package.json or release tag; versions below `v2.21.2` are in the stated range.\n- Look for user-facing access to `/api/source/test`, `/api/proxy`, `/api/search` or `/api/detail` on your deployment.","fix":"- LibreTV: upgrade to `v2.21.2` or later.","status":"open","published_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:43:30+00:00","updated_at":"2026-11-05T19:43:30+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T19:43:30Z","model":"claude-haiku-5-5","output":{"fix":"- LibreTV: upgrade to `v2.21.2` or later.","reach":"internet","title":"LibreTV: authenticated users can reach internal hosts via DNS rebinding","impact":"medium","summary":"LibreTV before v2.21.2 has a server-side request forgery flaw: an authenticated user can make the server fetch internal addresses by using a DNS name that resolves to a public address during validation and an internal one at connection time. An attacker could reach loopback services, private hosts or cloud metadata endpoints through the proxy, search and detail APIs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["libretv","self-hosted","cloud-metadata"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server reads internal services and cloud metadata credentials","analyst_note":"","how_to_check":"- Check the LibreTV version in the deployed package.json or release tag; versions below `v2.21.2` are in the stated range.\n- Look for user-facing access to `/api/source/test`, `/api/proxy`, `/api/search` or `/api/detail` on your deployment.\n- unknown whether the sources give further checks.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"Teams that self-host LibreTV and let users log in to it are exposed, because the flaw needs an authenticated account and reaches the server's own network. Deployments that are not reachable by user accounts, or that restrict outbound network access from the app server, are less exposed. The sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000734,"input_tokens":4337,"output_tokens":600,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123207':13A,16A '-2026':12A,15A '/api/detail':131C '/api/proxy':128C '/api/search':129C '/api/source/test':127C 'address':45B,56B,117C,122C 'allow':97C 'api':84B 'attack':67B,110C 'authent':2A,37B,98C 'authorit':112C 'bypass':101C 'checkupstreamallow':102C 'cloud':18B,75B,139C 'cloud-metadata':17B 'connect':64B,124C 'contain':88C 'control':111C 'could':68B 'cve':11A,14A 'detail':83B 'dns':9A,49B,106C,113C 'endpoint':77B,141C 'exploit':104C 'fetch':43B 'fetchwithsaferedirect':109C 'flaw':35B 'forgeri':34B,94C 'host':7A,24B,73B,137C 'intern':6A,44B,61B,121C 'libretv':1A,20B,25B,85C 'loopback':70B,134C 'make':40B 'metadata':19B,76B,140C 'name':50B 'one':62B 'privat':72B,136C 'proxi':80B 'public':55B,116C 'reach':5A,69B,133C 'rebind':10A 'request':33B,93C 'resolut':107C 'resolv':52B 'return':115C 'search':81B 'self':23B 'self-host':22B 'server':31B,42B,91C 'server-sid':30B,90C 'servic':71B,135C 'side':32B,92C 'time':65B,125C 'unpin':105C 'use':47B 'user':3A,38B,99C 'v2.21.2':27B,87C 'valid':58B,119C 'via':8A,126C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host LibreTV and let users log in to it are exposed, because the flaw needs an authenticated account and reaches the server's own network. Deployments that are not reachable by user accounts, or that restrict outbound network access from the app server, are less exposed. The sources do not say whether managed hosting is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudmetadata","libretv","low","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123207","severity":null,"published_at":"2026-11-05T19:17:20+00:00","modified_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null}],"documents":[{"id":79210,"url":"https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79211,"url":"https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79212,"url":"https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}