CVE-2026-72597: Friendica SSRF Vulnerability

CVE-2026-72597 Overview

CVE-2026-72597 is a server-side request forgery (SSRF) vulnerability affecting Friendica through the 2026.08-dev branch. The flaw resides in the link-preview endpoint, which fetches any user-supplied URL without validating the destination against an internal IP deny list. Authenticated users, including those holding free self-registered accounts, can abuse the endpoint to probe internal network services or query cloud metadata endpoints. The weakness is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Low-privileged attackers can pivot the Friendica server into an internal reconnaissance proxy and reach cloud metadata services that expose instance credentials.

Affected Products

Friendica through the 2026.08-dev development branch
Deployments exposing the link-preview endpoint to authenticated users
Instances permitting self-registration of free user accounts

Discovery Timeline

2026-08-11 - CVE-2026-72597 published to the National Vulnerability Database
2026-08-11 - Entry last modified in the NVD database

Technical Details for CVE-2026-72597

Vulnerability Analysis

The link-preview endpoint in Friendica accepts arbitrary URLs supplied by authenticated users and performs outbound HTTP requests on their behalf. The server returns metadata parsed from the fetched resource, which discloses response characteristics to the requester. Because the fetching logic does not enforce an internal address deny list, requests targeting 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and link-local ranges succeed.

Attackers can leverage this behavior to enumerate internal services that would otherwise be unreachable from the public internet. Response differentials such as status codes, content length, and timing reveal which internal hosts and ports respond. The impact escalates in cloud deployments, where the endpoint can query metadata services such as http://169.254.169.254/ to retrieve instance role credentials.

Root Cause

The root cause is missing destination validation in the URL-fetching routine that backs the link-preview feature. The code trusts user-supplied URLs and does not resolve hostnames against a blocklist of private, loopback, or metadata address ranges before issuing the request. This is a classic instance of CWE-918, where server-side fetch logic fails to constrain the target.

Attack Vector

Exploitation requires only a valid authenticated session, which any user of an open-registration instance can obtain. The attacker submits a crafted URL to the link-preview endpoint pointing at an internal address or cloud metadata service. The Friendica server issues the outbound request and returns preview data reflecting the response. Refer to the Friendica GitHub repository for source-level context on the affected endpoint.

Detection Methods for CVE-2026-72597

Indicators of Compromise

Outbound HTTP requests from the Friendica host to RFC1918 addresses or 169.254.169.254
Repeated link-preview requests from a single account targeting sequential internal IPs or ports
Unexpected access log entries showing authenticated preview calls with non-public URL parameters

Detection Strategies

Inspect Friendica application logs for link-preview requests whose target hostnames resolve to internal or link-local ranges
Correlate web-server access logs with egress firewall logs to identify preview-driven internal scans
Alert on any process on the Friendica host initiating connections to cloud metadata IPs when no legitimate workload requires them

Monitoring Recommendations

Enable verbose logging on the link-preview handler to capture the full requested URL and response code
Baseline normal preview traffic patterns and flag anomalous request volumes from individual accounts
Monitor newly registered accounts for early behavior that includes preview requests to numeric IP addresses

How to Mitigate CVE-2026-72597

Immediate Actions Required

Disable self-registration on public Friendica instances until a patched build is deployed
Restrict egress from the Friendica server to only the destinations required for federation
Block outbound access from the server to cloud metadata endpoints such as 169.254.169.254

Patch Information

No fixed release is referenced in the NVD entry at publication. Track the Friendica GitHub repository for commits addressing the link-preview validation gap and upgrade once a hardened release is available.

Workarounds

Place an egress proxy in front of the Friendica server that denies requests to private and link-local address ranges
Configure host firewall rules to prevent the Friendica process from initiating connections to internal subnets
Require IMDSv2 with hop-limit 1 on AWS instances to blunt metadata theft via SSRF

bash

# Example iptables egress restriction for the Friendica host
iptables -A OUTPUT -m owner --uid-owner friendica -d 127.0.0.0/8    -j REJECT
iptables -A OUTPUT -m owner --uid-owner friendica -d 10.0.0.0/8     -j REJECT
iptables -A OUTPUT -m owner --uid-owner friendica -d 172.16.0.0/12  -j REJECT
iptables -A OUTPUT -m owner --uid-owner friendica -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner friendica -d 169.254.0.0/16 -j REJECT