CVE-2026-108735: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-108735 is a Server-Side Request Forgery (SSRF) vulnerability in Miniflux, a minimalist feed reader application. It affects Miniflux versions 2.3.0 through 2.3.3, where authenticated users can set a feed's proxy_url to point at loopback or internal hosts, bypassing the FETCHER_ALLOW_PRIVATE_NETWORKS security check. The vulnerability was published on October 11, 2026, and a patch is available. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, VulnCheck).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from insufficient validation of the per-feed proxy_url configuration field. In request_builder.go (lines 155–220), when a feedProxyURL is set, it is parsed and used directly as the HTTP transport proxy without verifying whether the proxy host resolves to a private or loopback address — a check that is otherwise enforced via the directDialer.Control callback for direct connections. The IsNonPublicIP function in urllib/url.go (lines 64–72) correctly identifies private, loopback, link-local, and RFC 6598 addresses, but this check is only applied to the final destination of direct requests, not to the proxy endpoint itself. As a result, an authenticated user can configure proxy_url to http://127.0.0.1:<port> or any internal address, causing the Miniflux server to forward feed-fetching requests through that internal proxy, effectively probing internal services (Miniflux Source, HackMD Write-up).

Successful exploitation allows any authenticated Miniflux user to bypass network access controls and probe internal infrastructure from the server's network perspective. An attacker can enumerate open ports on loopback and internal hosts, interact with internal HTTP services (e.g., metadata APIs, admin panels, databases with HTTP interfaces), and potentially extract sensitive information from those services. The impact is limited to confidentiality (no integrity or availability impact), but the ability to reach internal services could facilitate lateral movement or further attacks against otherwise inaccessible systems (Github Advisory, VulnCheck).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access (low privileges), making it less immediately dangerous than unauthenticated SSRFs, but any registered Miniflux user can exploit it. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, VulnCheck).

1. Authenticate: Log in to a Miniflux instance running version 2.3.0–2.3.3 with any valid user account.
2. Create or edit a feed: Navigate to the feed management interface and create a new feed or edit an existing one.
3. Set a malicious proxy_url: In the feed's proxy URL field, enter an internal or loopback address, e.g., http://127.0.0.1:8080 or http://192.168.1.1:80, targeting a suspected internal service.
4. Trigger a feed fetch: Save the feed configuration and trigger a manual refresh or wait for the scheduled fetch. Miniflux will use the configured proxy_url as the HTTP proxy for the feed request, routing the outbound connection through the specified internal address.
5. Observe responses: Analyze the feed fetch results, error messages, or timing differences to infer whether the internal port is open and what service is running — effectively performing internal port scanning and service probing from the server's network context (HackMD Write-up, Miniflux Source).

• Logs: Miniflux application logs showing feed fetch requests with client_proxy_url set to loopback (127.0.0.1, ::1) or RFC 1918 private addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x); connection errors or timeouts to internal hosts logged during feed refresh cycles.
• Database: Feed records in the PostgreSQL database with proxy_url values pointing to internal or loopback addresses — query: SELECT id, feed_url, proxy_url FROM feeds WHERE proxy_url IS NOT NULL AND proxy_url != '';
• Network: Outbound TCP connections from the Miniflux server process to internal network addresses on non-standard ports, particularly during feed fetch intervals; repeated connection attempts to the same internal host/port combinations suggesting port scanning behavior.

Upgrade Miniflux to a version beyond 2.3.3, which addresses the SSRF bypass in the per-feed proxy URL handling. As a configuration-based workaround, restrict feed management permissions to trusted users only and avoid granting general user access to proxy URL configuration. Additionally, implement network segmentation to isolate the Miniflux server from sensitive internal services, and monitor feed proxy_url fields in the database for suspicious internal address values. Administrators should also ensure FETCHER_ALLOW_PRIVATE_NETWORKS is set to false (the default) to maintain the intended access control posture (Github Advisory, VulnCheck).

The vulnerability was assigned by VulnCheck and published to the GitHub Advisory Database on October 11, 2026, with a technical write-up available on HackMD. Community and media reaction has been limited given the moderate severity and authentication requirement. No notable vendor statements beyond the advisory or significant social media discussion have been identified at this time (Github Advisory, HackMD Write-up).