CVE-2026-54493: Koel Music Streaming SSRF Vulnerability

CVE-2026-54493 Overview

CVE-2026-54493 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Koel, an open-source music streaming solution. Versions prior to 9.7.0 expose the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes without the SafeUrl and HasAudioContentType validation applied by the regular radio API. An authenticated user can register an arbitrary streamUrl, then request /radio/stream/{id} to receive the upstream response body. This grants attackers access to loopback interfaces, RFC1918 networks, Docker bridge addresses, cloud metadata services, and other internal HTTP endpoints reachable from the Koel server.

Critical Impact
Authenticated attackers can proxy HTTP requests through the Koel server to reach internal-only services, including cloud instance metadata endpoints that may return credentials.

Affected Products

Koel music streaming server versions prior to 9.7.0
Deployments exposing Subsonic-compatible API routes
Koel instances running behind cloud metadata services (AWS, Azure, GCP)

Discovery Timeline

2026-08-19 - CVE-2026-54493 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-54493

Vulnerability Analysis

The vulnerability resides in Koel's Subsonic API compatibility layer. The regular radio API applies two validation rules: SafeUrl blocks non-public destinations, and HasAudioContentType verifies the response content type. The Subsonic-compatible request classes omit both checks, creating a divergence between the two ingress paths for the same underlying resource.

When a client calls /radio/stream/{id}, Koel invokes RadioStreamProxy::openStream(), which executes fopen($url, 'r', false, $context) against the stored URL. The response body is streamed back to the requester. This turns Koel into an HTTP proxy for any destination reachable from the server, including internal management interfaces and cloud metadata IMDS endpoints.

Root Cause

The root cause is missing input validation in app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php and app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php. Both request classes accepted streamUrl without applying the SafeUrl and HasAudioContentType rules used elsewhere. The stored URL was then passed through app/Services/RadioService.php to app/Services/Radio/RadioStreamProxy.php without further sanitization.

Attack Vector

An authenticated Koel user submits a crafted createInternetRadioStation.view request with streamUrl pointing at an internal address such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8080/admin. The user then requests /radio/stream/{id}, and Koel returns the upstream response body. No elevated privileges are required beyond a standard authenticated session.

php

// Patch: app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php
 namespace App\Http\Requests\Subsonic;
 
 use App\Http\Requests\Request;
+use App\Rules\HasAudioContentType;
+use App\Rules\SafeUrl;
 
 /**
  * @property string $streamUrl
// Source: https://github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f

Detection Methods for CVE-2026-54493

Indicators of Compromise

POST requests to /api/createInternetRadioStation.view or /api/updateInternetRadioStation.view containing streamUrl values referencing loopback (127.0.0.1, ::1), link-local (169.254.169.254), or RFC1918 addresses.
GET requests to /radio/stream/{id} returning non-audio content types such as application/json, text/html, or text/plain.
Outbound HTTP connections from the Koel process to internal IP ranges, container bridge networks, or cloud metadata endpoints.

Detection Strategies

Inspect Koel access logs for Subsonic radio-creation calls originating from non-administrative accounts and correlate with subsequent /radio/stream/{id} fetches.
Alert on any egress from the Koel host to 169.254.169.254, Docker bridge subnets, or internal management VLANs where such traffic is not expected.
Review the internet_radio_stations database table for streamUrl values that resolve to private, loopback, or link-local addresses.

Monitoring Recommendations

Enable request-body logging on the reverse proxy fronting Koel to capture streamUrl parameters for forensic review.
Instrument PHP fopen and stream context usage with runtime application self-protection or Falco rules to flag connections to non-audio destinations.
Forward Koel application logs and network flow data to a centralized SIEM to hunt for repeated SSRF probing patterns across accounts.

How to Mitigate CVE-2026-54493

Immediate Actions Required

Upgrade Koel to version 9.7.0 or later, which introduces SafeUrl and HasAudioContentType validation on Subsonic radio requests.
Rotate any credentials, tokens, or session material that the Koel host could have retrieved from cloud metadata services if exploitation is suspected.
Audit existing internet radio station records and delete entries whose streamUrl points to internal, loopback, or metadata addresses.

Patch Information

The fix is delivered in Koel 9.7.0 via pull request #2545 and commit 1331f335. The patch adds SafeUrl and HasAudioContentType rules to the Subsonic request classes and introduces UnsafePodcastFeedUrlException for related feed handling. Details are documented in GHSA-6p96-cfg5-4vhp and the v9.7.0 release notes.

Workarounds

Restrict outbound network access from the Koel server using egress firewall rules that deny traffic to RFC1918 ranges, 169.254.169.254, and Docker bridge subnets.
Enforce IMDSv2 with hop-limit 1 on cloud instances so cloud metadata cannot be reached through server-side proxies.
Disable or block the createInternetRadioStation.view and updateInternetRadioStation.view Subsonic routes at the reverse proxy until the upgrade is applied.

bash

# Nginx example: block vulnerable Subsonic radio endpoints until patched
location ~* /rest/(create|update)InternetRadioStation\.view$ {
    return 403;
}