PT-2026-52545 · Samuelclay · Newsblur

George Chen · Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-56771

NVD

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-56771

Affected Products

Newsblur

References · 5

• https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520 · Patch
• https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56771 · Security Note
• https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0 · Note
• https://vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint · Note