CVE-2026-34577: Postiz SSRF Vulnerability

CVE-2026-34577 Overview

CVE-2026-34577 is a Server-Side Request Forgery (SSRF) vulnerability discovered in Postiz, an AI-powered social media scheduling tool. The vulnerability exists in the GET /public/stream endpoint within the PublicController, which accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation performed is checking if the URL ends with .mp4, which can be trivially bypassed by appending .mp4 as a query parameter value or URL fragment. This endpoint requires no authentication and has no SSRF protections, enabling unauthenticated attackers to read responses from internal services, cloud metadata endpoints, and other network-internal resources.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to access internal network resources, cloud metadata services (such as AWS IMDSv1), and sensitive internal APIs without any authentication required.

Affected Products

• Postiz versions prior to 2.21.3
• Self-hosted Postiz deployments with publicly accessible /public/stream endpoint
• Cloud-hosted instances without network-level SSRF protections

Discovery Timeline

• 2026-04-02 - CVE-2026-34577 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34577

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability stems from insufficient input validation in the public streaming endpoint. The application proxies arbitrary HTTP requests on behalf of users, returning the full response content. The endpoint's intended purpose appears to be streaming media files (specifically .mp4 videos), but the weak validation mechanism allows attackers to redirect requests to arbitrary destinations.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes flaws where a web application fetches remote resources based on user-supplied input without properly validating the destination URL. In this case, the validation is trivially bypassable, making the endpoint an effective SSRF gateway.

Root Cause

The root cause is inadequate URL validation in the PublicController's stream endpoint. The application only checks whether the URL string ends with .mp4 using a simple suffix check. This validation approach fails to consider that:

1. Query parameters can append .mp4 to any URL (e.g., http://internal-service/?file=.mp4)
2. URL fragments can contain .mp4 suffix (e.g., http://169.254.169.254/latest/meta-data#.mp4)
3. The validation does not verify the actual content type of the response
4. No allowlist or blocklist filtering is applied to target hosts or IP ranges

Attack Vector

The vulnerability is exploitable remotely over the network without any authentication. An attacker can craft malicious URLs targeting internal services by appending .mp4 to bypass the validation check. Common attack scenarios include:

Cloud Metadata Access: Attackers can target cloud provider metadata endpoints such as AWS EC2's http://169.254.169.254/latest/meta-data/ to retrieve instance credentials, IAM role tokens, and sensitive configuration data.

Internal Service Enumeration: The SSRF can be used to probe internal network services, discover internal APIs, and access services that are not exposed to the public internet.

Sensitive Data Exfiltration: Responses from internal services are proxied directly back to the attacker, enabling extraction of configuration files, database connection strings, and other sensitive information accessible from the server's network position.

The attack does not require user interaction and can be executed with a simple HTTP GET request to the vulnerable endpoint.

Detection Methods for CVE-2026-34577

Indicators of Compromise

• Unusual HTTP requests to the /public/stream endpoint containing internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests targeting cloud metadata endpoints such as 169.254.169.254 or fd00:ec2::254
• Multiple sequential requests to the stream endpoint from the same source with varying URL targets
• Requests containing URL query parameters or fragments designed to bypass the .mp4 suffix check

Detection Strategies

• Monitor web server access logs for /public/stream requests with suspicious URL patterns indicating internal network targeting
• Implement egress traffic monitoring to detect outbound connections from the Postiz application to internal IP ranges or metadata services
• Deploy web application firewall (WAF) rules to detect and block SSRF attack patterns in URL parameters
• Configure network-level alerting for connections from web application servers to cloud metadata endpoints

Monitoring Recommendations

• Enable detailed request logging for the /public/stream endpoint including full URL parameter values
• Set up alerts for any requests to the stream endpoint containing internal IP address ranges or localhost references
• Monitor for increased error rates or unusual response sizes from the stream endpoint that may indicate reconnaissance activity
• Implement rate limiting on the public stream endpoint to slow down automated enumeration attempts

How to Mitigate CVE-2026-34577

Immediate Actions Required

• Upgrade Postiz to version 2.21.3 or later immediately to apply the security patch
• If immediate patching is not possible, disable or restrict access to the /public/stream endpoint at the reverse proxy or firewall level
• Review server logs for evidence of exploitation attempts targeting the vulnerable endpoint
• Rotate any credentials that may have been exposed if cloud metadata access is suspected
• Implement network-level SSRF protections to block requests to internal IP ranges and metadata endpoints

Patch Information

The vulnerability has been patched in Postiz version 2.21.3. Organizations should update to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory GHSA-mv6h-v3jg-g539 and the GitHub Release v2.21.3.

Workarounds

• Deploy a web application firewall (WAF) with SSRF protection rules to filter malicious URL parameters before they reach the application
• Restrict network egress from the Postiz application server to only necessary external destinations using firewall rules
• If running on AWS, enable IMDSv2 to require session tokens for metadata access, reducing the impact of potential SSRF exploitation
• Consider placing the Postiz application behind an authenticated reverse proxy to prevent unauthenticated access to the vulnerable endpoint

# Example: Block internal IP ranges at the network level (iptables)
# Prevent the web application from making requests to internal networks
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP