Live › vulnerability › CVE-2026-55598
PinePods, a self-hosted podcast manager written in Rust, fetches podcast enclosure URLs from user-added RSS feeds without checking the destination host. A logged-in user can make the server request loopback, private-network and cloud metadata addresses and read the responses it saves.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Self-hosted PinePods instances below 0.9.0 where users can add podcast feeds and episode downloads are enabled, which is the default. Any authenticated account can trigger the server-side requests, and self-service signup makes that easy to get. Managed hosting that does not run PinePods itself, and instances already on 0.9.0 or later, can skip it.
No product ranges from the sources yet.
0.9.0 are affected.0.9.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through POST /api/data/add_podcast in rust-api/src/handlers/podcasts.rs. get_podcast_values and add_episodes in rust-api/src/database.rs parse the feed with feed-rs and store the <enclosure url> verbatim in Episodes.episodeurl without destination host/IP validation. POST /api/data/download_podcast invokes spawn_download_podcast_episode and download_episode_and_wait() in rust-api/src/services/tasks.rs, which sends a reqwest GET to the stored URL and saves and records the response in DownloadedEpisodes for later retrieval. The estimate_duration_from_audio_url_async() path in rust-api/src/database.rs also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-55598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.