---
id: "CVE-2026-55598"
kind: "vulnerability"
aliases: ["CVE-2026-55598"]
title: "PinePods: podcast feed enclosures let users reach internal services"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloud-metadata", "package", "pinepods", "rust", "self-hosted"]
not_affected_if: ["downloads-disabled", "fixed-0.9.0", "no-user-accounts"]
published_at: "2026-10-30T20:17:10+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55598", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# PinePods: podcast feed enclosures let users reach internal services

PinePods, a self-hosted podcast manager written in Rust, fetches podcast enclosure URLs from user-added RSS feeds without checking the destination host. A logged-in user can make the server request loopback, private-network and cloud metadata addresses and read the responses it saves.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the PinePods version the server runs; versions before `0.9.0` are affected.
- Confirm whether episode downloads are enabled on the server (on by default, per the sources).
- Check whether self-service signup is open, since any account can add a feed.

## Fix

- Upgrade PinePods to `0.9.0` or later.

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55598

## From the sources

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_