CVE-2026-42180: Lemmy SSRF Vulnerability

CVE-2026-42180 Overview

CVE-2026-42180 is a Server-Side Request Forgery (SSRF) vulnerability in Lemmy, a federated link aggregator and forum platform. The flaw affects all versions prior to 0.19.18. An authenticated low-privileged user can submit a link post through POST /api/v3/post containing a URL pointing at internal infrastructure. The backend asynchronously sends a Webmention request to that target without filtering loopback, private, or link-local addresses. This lets an attacker coerce the Lemmy server into making outbound HTTP requests to internal services [CWE-918].

Critical Impact
Authenticated users can pivot through the Lemmy backend to probe and interact with internal network services that should not be reachable from the public internet.

Affected Products

Lemmy versions prior to 0.19.18
Public Lemmy instances that accept user registrations
Lemmy deployments hosting public communities accepting link posts

Discovery Timeline

2026-05-08 - CVE-2026-42180 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42180

Vulnerability Analysis

Lemmy supports the Webmention protocol, which notifies external sites when they are linked from a post. When a user creates a link post in a public community, the backend queues an asynchronous Webmention HTTP request to the submitted URL. The audited code path validates only URL syntax and scheme. It does not enforce a deny list for loopback addresses (127.0.0.0/8), RFC 1918 private ranges, or link-local destinations (169.254.0.0/16). This omission converts a routine social feature into an SSRF primitive.

Root Cause

The root cause is insufficient destination validation before issuing outbound HTTP requests. The Webmention sender trusts syntactic checks on the user-supplied URL. It performs no DNS resolution gating or IP range filtering before connecting. Any authenticated user with permission to post can supply a URL such as http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/ and force the backend to issue the request.

Attack Vector

An attacker registers a low-privileged account on a vulnerable Lemmy instance. They submit a link post in any public community with the url field set to an internal target. The Lemmy backend resolves and connects to that target during asynchronous Webmention dispatch. Responses are not returned directly to the attacker, but the request itself is sufficient to reach unauthenticated internal admin panels, cloud metadata endpoints, and to perform internal port scanning by observing timing or post creation behavior. See the GitHub Security Advisory GHSA-3jvj-v6w2-h948 for additional technical details.

Detection Methods for CVE-2026-42180

Indicators of Compromise

Outbound HTTP requests from the Lemmy backend container to loopback, RFC 1918, or 169.254.169.254 cloud metadata addresses.
Newly created link posts containing URLs with raw IP literals targeting internal ranges.
Spikes in Webmention dispatch errors in Lemmy worker logs correlated with single user accounts.

Detection Strategies

Inspect application logs for POST /api/v3/post calls where the submitted url parameter resolves to private address space.
Monitor egress network flows from Lemmy hosts and alert on connections to internal subnets or cloud metadata services.
Correlate post creation events with outbound DNS queries from the backend to detect probing of internal hostnames.

Monitoring Recommendations

Enable egress filtering logs on the host or namespace running the Lemmy backend.
Track per-user post creation rates and flag accounts submitting many distinct IP-based URLs.
Audit Webmention worker queues for repeated failures against non-routable destinations.

How to Mitigate CVE-2026-42180

Immediate Actions Required

Upgrade Lemmy to version 0.19.18 or later, which contains the patched Webmention validation.
Restrict the Lemmy backend's egress to only the public internet using firewall rules or a network policy.
Block backend access to cloud instance metadata endpoints such as 169.254.169.254.

Patch Information

The maintainers fixed CVE-2026-42180 in Lemmy 0.19.18. The release rejects loopback, private, and link-local destinations before the Webmention request is issued. Refer to the Lemmy 0.19.18 release notes for full upgrade guidance.

Workarounds

Disable outbound Webmention dispatch at the reverse proxy if upgrading is not immediately possible.
Place the Lemmy backend behind an egress proxy that enforces a destination allow list.
Apply NetworkPolicy or security group rules denying backend traffic to internal CIDR ranges.

bash

# Example iptables egress filter blocking SSRF targets from the Lemmy backend
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT