CVE-2026-50888: Koillection v1.8.0 SSRF Vulnerability

CVE-2026-50888 Overview

CVE-2026-50888 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in the custom scraper subsystem of Benjamin Jonard Koillection v1.8.0. Koillection is a self-hosted collection management web application. An authenticated attacker can supply a crafted URL to the scraper, causing the server to issue HTTP requests to attacker-chosen destinations. This enables scanning of internal network resources and interaction with services that should be unreachable from the public internet. The flaw is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
An authenticated user can leverage the scraper to probe internal infrastructure, access metadata endpoints, and interact with services bound to localhost or RFC1918 networks.

Affected Products

Benjamin Jonard Koillection v1.8.0
Self-hosted Koillection deployments exposing the custom scraper feature
Containerized Koillection instances with access to internal networks

Discovery Timeline

2026-06-15 - CVE-2026-50888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50888

Vulnerability Analysis

The vulnerability resides in Koillection's custom scraper subsystem. The scraper accepts a user-supplied URL and fetches its content on behalf of the authenticated user. The application does not adequately validate or restrict the destination of these outbound requests. An attacker with valid credentials can submit URLs pointing to internal hosts, loopback addresses, or cloud metadata services.

Because the server performs the HTTP request, the destination treats the traffic as originating from inside the trust boundary. Responses or response timing can then be used to enumerate internal services. The issue maps to CWE-918 and applies wherever Koillection v1.8.0 has network reachability to sensitive internal endpoints. EPSS data published 2026-06-18 lists the probability at 0.248%.

Root Cause

The scraper component fails to enforce an allowlist of permitted destinations and does not block requests to private, loopback, link-local, or reserved IP ranges. URL parsing occurs without resolving the hostname and validating the resulting IP address before the outbound request is dispatched. Redirect handling and DNS rebinding mitigations are also absent.

Attack Vector

Exploitation requires a network-reachable Koillection instance and valid authentication. The attacker submits a crafted URL to the custom scraper, such as http://127.0.0.1:6379/ to reach a local Redis instance or http://169.254.169.254/latest/meta-data/ to interact with cloud instance metadata. The server fetches the URL and returns response data or observable side effects, enabling internal port and service enumeration.

A proof-of-concept is published as a GitHub Gist. No verified exploit code is reproduced here; refer to the gist for technical details.

Detection Methods for CVE-2026-50888

Indicators of Compromise

Outbound HTTP requests from the Koillection application server to RFC1918, loopback (127.0.0.0/8), or link-local (169.254.0.0/16) address ranges
Scraper job entries containing URLs targeting internal hostnames, IP literals, or cloud metadata endpoints
Unexpected authentication or access patterns from low-privilege Koillection accounts immediately followed by scraper activity

Detection Strategies

Inspect Koillection application logs for scraper invocations and record submitted URLs for review
Correlate web application logs with egress firewall logs to identify scraper-initiated requests to non-public destinations
Alert on DNS resolutions from the Koillection host that resolve to private or reserved address space

Monitoring Recommendations

Monitor egress traffic from the Koillection server and baseline expected destinations
Track authenticated session activity that triggers a high volume of scraper requests in a short window
Capture and retain full request URLs submitted to the scraper endpoint for forensic review

How to Mitigate CVE-2026-50888

Immediate Actions Required

Restrict access to the Koillection custom scraper feature to trusted administrators only
Place the Koillection server behind an egress proxy that blocks requests to private, loopback, and metadata IP ranges
Audit existing user accounts and disable or rotate credentials for unknown or unused accounts

Patch Information

No vendor patch is referenced in the available CVE data at the time of publication. Monitor the Koillection project for updates beyond v1.8.0 and apply security releases as they become available.

Workarounds

Deploy network-level controls that prevent the Koillection container or host from reaching 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16
Disable the custom scraper subsystem if it is not required for business operations
Require strong authentication and limit account creation to reduce the population of users able to invoke the scraper
Enable IMDSv2 on AWS workloads to prevent unauthenticated metadata retrieval via SSRF

bash

# Example iptables egress restriction for the Koillection host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT