CVE-2026-18736: Shlink SSRF Vulnerability

CVE-2026-18736 Overview

CVE-2026-18736 is a server-side request forgery (SSRF) vulnerability in Shlink, an open-source self-hosted URL shortener. The flaw allows authenticated API key holders to force the Shlink server to issue arbitrary HTTP GET requests. Exploitation occurs during short URL creation when title auto-resolution is enabled. An attacker supplies a public URL that redirects to internal targets such as loopback addresses, link-local ranges, or cloud metadata endpoints like 169.254.169.254. The HTML <title> element of the fetched response is returned in the short URL creation response, enabling exfiltration of internal service data.

Critical Impact
Authenticated attackers can pivot Shlink into a proxy for reading internal HTTP services and cloud metadata endpoints, exposing credentials and infrastructure details.

Affected Products

Shlink (self-hosted URL shortener)
Deployments with short URL title auto-resolution enabled
Instances issuing API keys to untrusted or semi-trusted users

Discovery Timeline

2026-08-03 - CVE-2026-18736 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18736

Vulnerability Analysis

The vulnerability [CWE-918] resides in Shlink's title auto-resolution feature. When a user creates a short URL through the API, Shlink can fetch the destination page and parse the HTML <title> element to store as metadata. The fetcher follows HTTP redirects without validating the final destination against an allowlist or IP-range blocklist. An authenticated attacker submits a URL pointing to a public host under their control. That host issues a redirect to an internal address, and Shlink obediently issues the follow-up request. The parsed title from the internal response is echoed back in the API response body, giving the attacker a read primitive against internal HTTP endpoints.

Root Cause

The root cause is missing egress validation in the URL fetching component. Shlink treats redirects as trusted continuations of the original user-supplied URL. It does not enforce network boundary checks against loopback (127.0.0.0/8), link-local (169.254.0.0/16), private RFC1918 ranges, or IPv6 equivalents before issuing follow-up requests.

Attack Vector

Exploitation requires network access to the Shlink API and a valid API key. The attacker crafts a POST request to the short URL creation endpoint with a longUrl value pointing to an attacker-controlled server that responds with an HTTP 302 redirect to an internal target. Common targets include the AWS Instance Metadata Service at http://169.254.169.254/latest/meta-data/, GCP metadata at http://metadata.google.internal/, or internal admin interfaces on 127.0.0.1. Shlink follows the redirect, fetches the internal resource, and returns the extracted <title> field in the JSON response. A working proof-of-concept is published in the GitHub SSRF Exploit Repository.

See the VulnCheck Advisory on Shlink SSRF for additional technical context.

Detection Methods for CVE-2026-18736

Indicators of Compromise

Outbound HTTP requests from the Shlink server to internal RFC1918 addresses, loopback, or link-local ranges shortly after short URL creation API calls
API access logs showing POST requests to the short URL creation endpoint containing longUrl values pointing to unusual external hosts followed by redirects
Short URL records where the stored title field contains fragments of internal HTTP responses, JSON metadata, or IAM credential strings
DNS queries from the Shlink host resolving metadata.google.internal, 169.254.169.254, or unexpected internal hostnames

Detection Strategies

Correlate Shlink application logs with network flow data to identify title-resolution fetches that terminate on internal IP ranges
Alert on Shlink process egress connections to cloud metadata service endpoints, which have no legitimate business purpose
Baseline the expected outbound destinations for the Shlink container or host and flag deviations

Monitoring Recommendations

Monitor egress traffic from URL-shortener workloads with a network security group or web proxy that blocks metadata endpoints and RFC1918 ranges
Enable verbose API audit logging on Shlink and forward to a centralized log platform for retention and query
Track API key usage patterns and flag keys that generate high volumes of short URL creation requests to unfamiliar domains

How to Mitigate CVE-2026-18736

Immediate Actions Required

Disable the short URL title auto-resolution feature in Shlink configuration until a patched version is deployed
Rotate all Shlink API keys and audit which identities hold key-issuing privileges
Apply cloud provider protections such as AWS IMDSv2 enforcement to block unauthenticated metadata retrieval
Restrict Shlink's outbound network access using a firewall or egress proxy that denies traffic to internal ranges and metadata endpoints

Patch Information

Refer to the GitHub Repository for Shlink for the latest release notes and patched versions. Administrators should upgrade to the fixed release identified in the vendor advisory and verify the title-resolution logic enforces destination validation after the update.

Workarounds

Set the title auto-resolution option to disabled in Shlink's configuration, requiring users to provide titles manually
Deploy Shlink behind an egress proxy that enforces an allowlist of destination domains for outbound HTTP fetches
Enforce IMDSv2 on AWS-hosted Shlink deployments to require session tokens for metadata access
Limit API key issuance to trusted administrators and revoke unused keys

bash

# Configuration example - disable title auto-resolution in Shlink
# In your .env or environment variables:
AUTO_RESOLVE_TITLES=false

# Enforce IMDSv2 on AWS EC2 instance hosting Shlink
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled