CVE-2026-72606: Pinry Server-Side Request Forgery Vulnerability

CVE-2026-72606 Overview

CVE-2026-72606 is a server-side request forgery (SSRF) vulnerability in Pinry through version 2.1.13. The flaw resides in the pin-from-URL feature, which passes user-supplied URLs directly to Python's requests.get() without host or IP address validation. Unauthenticated attackers can force the Pinry server to issue arbitrary HTTP requests to internal or external hosts. Because ALLOW_NEW_REGISTRATIONS defaults to true, anonymous users can trigger the request path without operator intervention. Attackers can pivot to internal services, administrative endpoints, or cloud metadata endpoints such as 169.254.169.254 to harvest instance credentials [CWE-918].

Critical Impact
Unauthenticated remote attackers can coerce vulnerable Pinry instances into contacting internal services and cloud metadata endpoints, exposing sensitive configuration and credentials.

Affected Products

Pinry versions through 2.1.13
Deployments with ALLOW_NEW_REGISTRATIONS set to the default value of true
Pinry instances hosted in cloud environments exposing instance metadata services

Discovery Timeline

2026-08-11 - CVE-2026-72606 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72606

Vulnerability Analysis

Pinry is a self-hosted tiled image board designed for organizing visual content. The pin-from-URL feature accepts a remote URL from the user and downloads the referenced image server-side. The application passes the supplied URL to requests.get() without validating the destination host, resolved IP address, or URL scheme.

An attacker submits a crafted URL pointing at an internal address. The Pinry backend performs the outbound HTTP request from its own network position, bypassing perimeter controls that would normally block external traffic. Response content and status codes returned to the attacker can enable blind and semi-blind SSRF discovery of internal services.

The default configuration compounds the risk. ALLOW_NEW_REGISTRATIONS defaults to true, so unauthenticated actors can register accounts and reach the pin creation endpoint without operator approval. See the Pinry GitHub repository for source and issue details.

Root Cause

The root cause is missing input validation on user-controlled URLs before they are fetched by the server. The code performs no allowlist of hostnames, no denylist of RFC1918 addresses, no protection against DNS rebinding, and no scheme restriction. This is a classic Server-Side Request Forgery pattern classified as [CWE-918].

Attack Vector

Exploitation requires only network reachability to the Pinry web interface. The attacker registers or reuses an anonymous account, then submits a pin whose source URL points to http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/ on GCP, or any internal service such as http://127.0.0.1:8080/admin. The server issues the request and processes the response. On cloud platforms without IMDSv2 enforcement, attackers can retrieve temporary IAM credentials tied to the Pinry instance role.

No authentication is required, no user interaction is needed, and attack complexity is low. Refer to the Pinry project repository for the affected feature implementation.

Detection Methods for CVE-2026-72606

Indicators of Compromise

Outbound HTTP requests from the Pinry server process to RFC1918 addresses, 127.0.0.1, or 169.254.169.254
Pin creation events with source URLs targeting internal hostnames, loopback addresses, or cloud metadata IPs
Anonymous account registrations followed immediately by pin-from-URL submissions
Unusual DNS lookups from the Pinry host for internal service names

Detection Strategies

Inspect Pinry application logs for pin creation requests where the url parameter resolves to private, link-local, or loopback ranges
Monitor egress traffic from the Pinry server and alert on connections to internal RFC1918 destinations or metadata endpoints
Correlate registration events against subsequent URL fetches to identify automated abuse patterns

Monitoring Recommendations

Enable network flow logging on the Pinry host and forward events to a centralized analytics platform
Baseline normal outbound destinations for the Pinry service and alert on deviations
Track cloud audit logs such as AWS CloudTrail for use of IAM credentials associated with the Pinry instance role from unexpected source addresses

How to Mitigate CVE-2026-72606

Immediate Actions Required

Set ALLOW_NEW_REGISTRATIONS to false to block anonymous account creation and reduce the attack surface
Restrict egress traffic from the Pinry server to the specific external endpoints required for legitimate image fetches
Enforce IMDSv2 on AWS deployments to require session tokens for metadata access
Rotate any IAM credentials or secrets accessible from the Pinry host as a precautionary measure

Patch Information

At time of publication, no fixed release is referenced in the NVD entry for versions above 2.1.13. Monitor the Pinry GitHub repository for security releases and apply updates when available.

Workarounds

Place the Pinry service behind an egress proxy that enforces an allowlist of permitted destination hosts
Block outbound connections to 169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 from the Pinry host
Require authentication for the pin creation endpoint by disabling open registration
Deploy a web application firewall rule to reject pin creation requests whose URL parameter resolves to internal address ranges

bash

# Example iptables rules blocking SSRF-relevant destinations from the Pinry host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT