CVE-2026-47260: Koel Music Streaming SSRF Vulnerability

CVE-2026-47260 Overview

CVE-2026-47260 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Koel, a free, open-source music streaming solution. Versions prior to 9.3.5 validate the podcast feed URL through the SafeUrl rule, but individual episode <enclosure url="..."> values extracted from the RSS XML are persisted to the database without SSRF validation. When a user plays an episode, the server fetches the enclosure URL via Http::sink()->get() and streams the response back, allowing full-read SSRF against internal services. The maintainers patched the issue in version 9.3.5.

Critical Impact
Authenticated attackers can coerce the Koel backend into fetching arbitrary internal URLs and read the responses, exposing internal services, metadata endpoints, and other non-public resources.

Affected Products

Koel music streaming server versions prior to 9.3.5
Self-hosted Koel deployments exposing podcast playback functionality
Koel instances reachable by any authenticated low-privilege user

Discovery Timeline

2026-06-12 - CVE-2026-47260 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47260

Vulnerability Analysis

Koel implements the SafeUrl validation rule that performs DNS resolution and verifies the result is a public IP address. This rule is applied when a user submits a podcast feed URL. However, the parsed RSS XML contains per-episode <enclosure url="..."> values that bypass this validation entirely. The application stores those URLs directly into the database without inspection. On playback, the backend issues an outbound HTTP request to the stored URL using Http::sink()->get() and streams the response to the client. Because the response body is returned to the requester, the SSRF is full-read rather than blind.

Root Cause

The root cause is incomplete input validation along the trust boundary. The SafeUrl rule only protected the feed URL, while episode enclosure URLs derived from untrusted XML were treated as safe. The patch introduces an UnsafeUrlException and applies SafeUrl plus a HasAudioContentType rule at podcast sync, playback, and the radio AI tool entry points.

Attack Vector

An authenticated attacker hosts a malicious RSS feed containing <enclosure> elements pointing to internal URLs such as http://127.0.0.1, http://169.254.169.254/latest/meta-data/, or other RFC1918 endpoints. The attacker adds the feed to Koel, then triggers episode playback. The Koel server fetches the internal URL and returns the response body to the attacker.

php

// Patch excerpt: introduction of UnsafeUrlException
<?php

namespace App\Exceptions;

use RuntimeException;

class UnsafeUrlException extends RuntimeException
{
    public static function forUrl(string $url): self
    {
        return new self(sprintf('Refusing to fetch URL that does not resolve to a public host: %s', $url));
    }
}
// Source: https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a

Detection Methods for CVE-2026-47260

Indicators of Compromise

Outbound HTTP requests from the Koel application server to RFC1918, loopback, or link-local addresses such as 169.254.169.254.
Podcast records in the database whose episode enclosure URLs reference internal hostnames or non-audio content types.
Unexpected access log entries on internal services originating from the Koel server's IP address.

Detection Strategies

Inspect the podcasts and episodes tables for enclosure URLs that resolve to private IP ranges or non-routable hosts.
Audit web server and reverse proxy logs for /play or episode streaming endpoints followed by outbound connections to internal hosts.
Correlate authenticated Koel user actions (feed addition, playback) with outbound network flows leaving the application host.

Monitoring Recommendations

Enforce egress filtering from the Koel host and alert on connection attempts to internal CIDRs or cloud metadata endpoints.
Monitor application logs for HTTP client errors against private addresses, indicating SSRF probing.
Track newly added podcast feeds by low-privilege users and flag those producing enclosure URLs with non-audio MIME types.

How to Mitigate CVE-2026-47260

Immediate Actions Required

Upgrade Koel to version 9.3.5 or later, which validates URLs at podcast sync, playback, and the radio AI tool.
Review existing podcast subscriptions and remove episodes whose enclosure URLs reference internal or non-public hosts.
Restrict Koel's outbound network access to required external destinations only.

Patch Information

The fix is published in commit 8708f077 and documented in GHSA-7j2f-6h2r-6cqc. It introduces UnsafeUrlException, applies the SafeUrl rule to enclosure URLs, and adds a HasAudioContentType check before fetching remote media.

Workarounds

Place Koel behind an egress proxy that denies requests to RFC1918, loopback, and cloud metadata addresses such as 169.254.169.254.
Disable the podcast feature or restrict feed creation to trusted administrators until the patch is applied.
Run the Koel application in a network segment with no route to sensitive internal services.

bash

# Example iptables egress restriction for the Koel host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT