CVE-2026-21885
Medium · 6.5Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
CVSS
6.5
EPSS
0.3%
Published
Jan 7, 2026
CISA due date
—
The record
Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | miniflux.app | 0 | No fix |
| Go | miniflux.app/v2 | 0 | 2.2.16 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GO-2026-4287 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources… Same vulnerability
- GO-2025-4226 Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app Also affects miniflux.app
- CVE-2025-67713 Miniflux 2 is an open source feed reader. Also affects miniflux.app
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb