CVE-2026-40168: Gitroom Postiz SSRF Vulnerability

CVE-2026-40168 Overview

Postiz is an AI-powered social media scheduling tool developed by Gitroom. A Server-Side Request Forgery (SSRF) vulnerability exists in versions prior to 2.21.5 within the /api/public/stream endpoint. The application validates initially supplied URLs and blocks direct requests to private or internal hosts; however, it fails to re-validate the final destination after following HTTP redirects. This allows an attacker to supply a public HTTPS URL that passes initial validation but redirects the server-side request to internal resources, potentially exposing sensitive data or enabling further attacks on internal infrastructure.

Critical Impact

Attackers can bypass URL validation through HTTP redirects to access internal network resources, potentially exposing cloud metadata services, internal APIs, and sensitive configuration data.

Affected Products

• Gitroom Postiz versions prior to 2.21.5

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-40168 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40168

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability exploits a common flaw in URL validation logic where initial validation checks are performed but subsequent redirect destinations are not re-validated. The /api/public/stream endpoint accepts user-supplied URLs and makes server-side HTTP requests to fetch content. While the application implements blocklist-based validation to prevent requests to private IP ranges (such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost, this validation only occurs on the initially supplied URL.

An attacker can craft a request to an externally controlled server that returns an HTTP redirect (301, 302, 307, or 308) pointing to an internal resource. Since the redirect target is not validated, the server follows the redirect and makes a request to the internal resource, returning the response to the attacker.

Root Cause

The vulnerability stems from CWE-918 (Server-Side Request Forgery) where input validation is incomplete. The validation logic only inspects the user-supplied URL before initiating the HTTP request but does not implement redirect validation or disable automatic redirect following. This creates a Time-of-Check Time-of-Use (TOCTOU) gap where the URL passes validation at check time but points to a different resource at use time due to the redirect.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sets up a malicious server that responds with HTTP redirects to internal targets. When the vulnerable endpoint processes the attacker's URL, the server follows the redirect to internal resources such as cloud metadata endpoints (http://169.254.169.254/), internal APIs, or administrative interfaces. The attacker receives the response content, enabling information disclosure from internal systems.

// Security patch removing unused import and fixing authentication service
// Source: https://github.com/gitroomhq/postiz-app/commit/30e8b777098157362769226d1b46d83ad616cb06

// In apps/backend/src/services/auth/auth.service.ts
   }
 
   private async jwt(user: User) {
+    if (user.password) {
+      delete user.password;
+    }
     return AuthChecker.signJWT(user);
   }
 }

The patch commit includes security hardening measures to prevent sensitive data exposure. For the complete SSRF fix details, see the GitHub Security Advisory GHSA-34w8-5j2v-h6ww.

Detection Methods for CVE-2026-40168

Indicators of Compromise

• Outbound HTTP requests from the Postiz server to cloud metadata endpoints (e.g., 169.254.169.254)
• HTTP 3xx redirect responses from external servers followed by internal resource access
• Unusual patterns in /api/public/stream endpoint access logs showing external URLs
• Server-side requests to internal IP ranges that did not originate from expected application flows

Detection Strategies

• Monitor network traffic for HTTP requests originating from the application server to internal IP ranges or localhost
• Implement web application firewall (WAF) rules to detect SSRF patterns in the /api/public/stream endpoint
• Analyze application logs for requests containing redirect chains that terminate at internal addresses
• Deploy network segmentation alerts for unexpected cross-boundary traffic from web application servers

Monitoring Recommendations

• Enable detailed access logging on the /api/public/stream endpoint with full URL parameters
• Configure alerts for outbound requests to RFC 1918 private address ranges from the application tier
• Monitor cloud metadata endpoint access from application servers using cloud provider security tools
• Implement DNS query logging to detect resolution of internal hostnames from unexpected sources

How to Mitigate CVE-2026-40168

Immediate Actions Required

• Upgrade Postiz to version 2.21.5 or later immediately
• Review application logs for signs of SSRF exploitation targeting internal resources
• Implement network-level controls to restrict outbound connections from the Postiz server
• Audit any data that may have been accessed through the vulnerable endpoint

Patch Information

Gitroom has released version 2.21.5 that addresses this vulnerability. The fix is available in commit 30e8b777098157362769226d1b46d83ad616cb06. Organizations should update immediately by pulling the latest release from the GitHub Release v2.21.5. Review the GitHub Security Advisory GHSA-34w8-5j2v-h6ww for additional details.

Workarounds

• Deploy a reverse proxy or WAF in front of the application that validates all outbound request destinations including after redirects
• Implement network-level egress filtering to prevent the application server from reaching internal IP ranges
• Disable or restrict access to the /api/public/stream endpoint until patching is complete
• Configure iptables or cloud security groups to block outbound connections to metadata services and internal networks

# Example iptables rules to block SSRF to common internal targets
# Block requests to cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block requests to private IP ranges (adjust based on your network)
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP