---
id: "CVE-2026-123207"
kind: "vulnerability"
aliases: ["CVE-2026-123207"]
title: "LibreTV: authenticated users can reach internal hosts via DNS rebinding"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cloud-metadata", "libretv", "other", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-11-05T19:17:20+00:00"
first_seen_at: "2026-11-05T19:40:36+00:00"
updated_at: "2026-11-05T19:43:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123207", "first_seen_at": "2026-11-05T19:40:36+00:00"}]
exploit_sources: []
---

# LibreTV: authenticated users can reach internal hosts via DNS rebinding

LibreTV before v2.21.2 has a server-side request forgery flaw: an authenticated user can make the server fetch internal addresses by using a DNS name that resolves to a public address during validation and an internal one at connection time. An attacker could reach loopback services, private hosts or cloud metadata endpoints through the proxy, search and detail APIs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the LibreTV version in the deployed package.json or release tag; versions below `v2.21.2` are in the stated range.
- Look for user-facing access to `/api/source/test`, `/api/proxy`, `/api/search` or `/api/detail` on your deployment.

## Fix

- LibreTV: upgrade to `v2.21.2` or later.

## Timeline

- 2026-11-05T19:40:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123207

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding
- [fix] Patch: github.com https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1
- [fix] Release notes: github.com https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2

## From the sources

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_