CVE-2026-21885: 
NixOS vulnerability analysis and mitigation

CVE-2026-21885 is a Server-Side Request Forgery (SSRF) vulnerability in Miniflux's media proxy endpoint that allows authenticated users to cause the server to fetch arbitrary internal resources. It affects Miniflux versions 2.0.0 through 2.2.15 (Go package miniflux.app/v2) and was disclosed on January 7, 2026, by researcher eclipse07077-ljw (jeongwoolee340@gmail.com). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Miniflux Advisory).

The root cause (CWE-918) lies in the media proxy handler (internal/ui/proxy.go, function (*handler).mediaProxy) for the route GET /proxy/{encodedDigest}/{encodedURL}. While the proxy validates the URL scheme and HMAC signature to prevent unsigned requests, it does not restrict target hosts or IP ranges, allowing requests to loopback addresses, private RFC1918 ranges, and link-local metadata endpoints (e.g., 169.254.169.254). An authenticated attacker can subscribe to a feed they control containing image URLs pointing to internal addresses; Miniflux rewrites these via mediaproxy.RewriteDocumentWithAbsoluteProxyURL(...) into signed /proxy/... URLs, which can then be requested to trigger the server-side fetch. The media proxy is enabled by default (MEDIA_PROXY_MODE=http-only), making most default deployments vulnerable (Miniflux Advisory).

Successful exploitation allows an authenticated attacker to read responses from internal services reachable by the Miniflux server, including localhost services, private network endpoints, and cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254). The confidentiality impact is rated High, as sensitive data such as cloud credentials, internal API responses, or configuration details may be exposed. Integrity and availability are not directly affected by this vulnerability (Github Advisory, Miniflux Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, describing the full exploitation flow using a controlled feed with internal-address image URLs. No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.04% per GitHub Advisory), placing it in the 12th percentile for exploitation likelihood. Detection plugins are available via Qualys (ID: 5006842) and Nessus (ID: 282485) (Github Advisory, Miniflux Advisory).

1. Reconnaissance: Identify a Miniflux instance running version ≤ 2.2.15 with the media proxy enabled (default: MEDIA_PROXY_MODE=http-only). Obtain or create a valid user account on the target instance.
2. Set up a malicious feed: Host an RSS/Atom feed containing an entry with an <img> tag whose src attribute points to an internal address reachable from the Miniflux server (e.g., http://127.0.0.1:8080/admin, http://169.254.169.254/latest/meta-data/, or a private RFC1918 address).
3. Subscribe to the feed: Log in to Miniflux and subscribe to the attacker-controlled feed. Miniflux will fetch the feed and rewrite media URLs through mediaproxy.RewriteDocumentWithAbsoluteProxyURL(...), generating HMAC-signed /proxy/{encodedDigest}/{encodedURL} URLs.
4. Extract the signed proxy URL: Open the feed entry in Miniflux and inspect the rendered HTML or page source to locate the rewritten /proxy/... URL corresponding to the internal address.
5. Trigger the SSRF: Send a GET request to the extracted /proxy/{encodedDigest}/{encodedURL} endpoint. Miniflux will fetch the internal URL server-side and return the response, exposing internal service data to the attacker (Miniflux Advisory).

• Network: Outbound HTTP requests from the Miniflux server process to loopback (127.0.0.1), private RFC1918 ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), or link-local addresses (169.254.169.254) initiated by the media proxy handler.
• Logs: Miniflux access logs showing repeated GET /proxy/... requests where the decoded target URL resolves to internal/private addresses; unusual HTTP responses from the proxy endpoint containing internal service data (e.g., JSON metadata, HTML admin panels).
• Application Behavior: Subscriptions to external feeds containing image URLs pointing to internal IP addresses or hostnames; feed entries with media proxy URLs encoding internal addresses in the {encodedURL} path component (Miniflux Advisory).

Upgrade Miniflux to version 2.2.16 or later, which patches the SSRF by adding host/IP restrictions to the media proxy (Miniflux Advisory). As a workaround for deployments that cannot immediately upgrade, disable the media proxy by setting MEDIA_PROXY_MODE=none in the Miniflux configuration, though this will prevent mixed-content proxying. Network-level controls such as egress firewall rules blocking the Miniflux process from accessing internal/metadata addresses (e.g., 169.254.169.254) can also reduce the attack surface.

The vulnerability was reported by researcher eclipse07077-ljw and published by Miniflux maintainer fguillot on January 7, 2026. Red Hat tracked the issue under their CVE database, and it was picked up by security scanners including Qualys and Tenable Nessus shortly after disclosure. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking (Miniflux Advisory).