CVE-2026-54544: Fireshare SSRF Vulnerability

CVE-2026-54544 Overview

CVE-2026-54544 is a Server-Side Request Forgery (SSRF) vulnerability in Fireshare, a self-hosted media and link sharing application. Two API endpoints, POST /api/test-discord-webhook and POST /api/test-webhook, lack the @login_required decorator. Unauthenticated attackers can invoke these endpoints and force the Fireshare server to issue arbitrary HTTP POST requests to any URL. Attackers can target internal network addresses and cloud metadata services without credentials, session cookies, or prior access. The flaw is classified under CWE-918. Version 1.6.16 contains a patch.

Critical Impact
Unauthenticated attackers can pivot into internal networks and exfiltrate cloud instance metadata credentials by abusing the Fireshare server as an SSRF proxy.

Affected Products

Fireshare versions prior to 1.6.16
Self-hosted Fireshare instances exposed to untrusted networks
Fireshare deployments running in cloud environments with instance metadata services (AWS IMDS, Azure IMDS, GCP metadata)

Discovery Timeline

2026-09-15 - CVE-2026-54544 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-54544

Vulnerability Analysis

The vulnerability resides in Fireshare's webhook testing functionality inside app/server/fireshare/api/misc.py. Two Flask route handlers accept POST requests and issue outbound HTTP POST requests to user-supplied URLs. Both routes omit the @login_required authentication decorator applied elsewhere in the API.

The endpoints accept a target URL in the JSON request body and forward the request server-side. Attackers control the destination and body of the outbound request. The server acts as a confused deputy, reaching resources unreachable from the attacker's network position.

Cloud-hosted Fireshare instances are exposed to credential theft. AWS Instance Metadata Service (IMDSv1) at http://169.254.169.254/latest/meta-data/ returns IAM role credentials on request. Similar endpoints exist on Azure and GCP. Attackers can also probe internal-only services such as databases, admin panels, and Kubernetes APIs.

Root Cause

The root cause is missing authorization enforcement on request-triggered outbound network functionality. The @login_required decorator was applied to sibling endpoints but omitted on the two webhook test routes. No allowlist or destination validation constrains the outbound URL.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to /api/test-discord-webhook or /api/test-webhook on a reachable Fireshare instance. The JSON body contains an attacker-chosen URL. Fireshare issues the outbound POST request from the server's network context, potentially reaching internal or metadata endpoints.

python

@api.route('/api/test-discord-webhook', methods=['POST'])
+@login_required
 @demo_restrict
 def test_discord_webhook():
     data = request.get_json()

Source: GitHub Commit 3d78684. The patch adds the missing @login_required decorator so only authenticated sessions can invoke the webhook test endpoints.

Detection Methods for CVE-2026-54544

Indicators of Compromise

Unauthenticated HTTP POST requests to /api/test-discord-webhook or /api/test-webhook in Fireshare access logs
Outbound HTTP POST requests from the Fireshare server to internal RFC1918 addresses or link-local metadata IPs such as 169.254.169.254
Unusual outbound traffic patterns originating from the Fireshare application process to non-Discord destinations

Detection Strategies

Review web server and reverse proxy access logs for requests to the two webhook test endpoints without preceding authentication
Inspect egress network telemetry from the Fireshare host for connections to cloud metadata endpoints or internal service ports
Correlate application logs with outbound firewall logs to identify server-initiated requests triggered by external clients

Monitoring Recommendations

Enable and retain HTTP request logs for the Fireshare reverse proxy, including source IP, path, and response code
Alert on any outbound connection from the Fireshare host to 169.254.169.254 or other metadata service addresses
Baseline expected outbound destinations for webhook traffic and alert on deviations

How to Mitigate CVE-2026-54544

Immediate Actions Required

Upgrade Fireshare to version 1.6.16 or later immediately
Restrict Fireshare's network egress to known webhook destinations using host firewall rules or network policies
Block the Fireshare host from reaching cloud instance metadata endpoints, or enforce IMDSv2 with hop-limit restrictions on AWS
Audit access logs for prior unauthenticated calls to the affected endpoints and rotate any credentials exposed via metadata services

Patch Information

Upgrade to Fireshare 1.6.16, which applies the @login_required decorator to /api/test-discord-webhook and /api/test-webhook. Review the GitHub Security Advisory GHSA-w7j7-gv7f-gj92 and the patch commit for full details.

Workarounds

Place Fireshare behind a reverse proxy that rejects unauthenticated requests to /api/test-discord-webhook and /api/test-webhook
Enforce IMDSv2 on AWS deployments to require session tokens for metadata access
Deploy egress filtering that restricts Fireshare to a documented allowlist of webhook targets

bash

# Example nginx block for the affected endpoints until patched
location ~ ^/api/test-(discord-)?webhook$ {
    return 403;
}