PT-2026-43257 · Karakeep · Karakeep

Tahirsercan · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-45082

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Karakeep versions prior to 0.32.0

Description A Server-Side Request Forgery (SSRF) protection bypass exists in redirect-following processing components. While the application includes protections to block requests to internal or private network destinations, these can be bypassed using crafted HTTP redirect chains. An authenticated user can use attacker-controlled redirects to force the application to send requests to internal Docker network services. This issue impacts several processing paths, specifically crawler-related functionality and video download processing flows.

Recommendations Update to version 0.32.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-45082

Affected Products

Karakeep

References · 3

• 🔥 https://github.com/karakeep-app/karakeep/security/advisories/GHSA-g647-327m-79g9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45082 · Security Note
• https://t.me/CVEtracker/54992 · Telegram Post