CVE-2026-7581: alexta69 MeTube RCE Vulnerability

CVE-2026-7581 Overview

CVE-2026-7581 is a permissive cross-origin resource sharing (CORS) policy vulnerability in alexta69 MeTube versions up to 2026.04.09. The flaw resides in the on_prepare function of app/main.py within the CORS Policy component. The application accepts cross-domain requests from untrusted origins, allowing remote attackers to interact with the MeTube interface from attacker-controlled domains. The issue is classified under CWE-346: Origin Validation Error. The exploit details have been publicly disclosed. Upgrading to version 2026.04.10 mitigates the issue via commit 0072d3488ae5b8d922d3ee87458d829993742a32.

Critical Impact
Remote attackers can leverage permissive CORS configuration to perform cross-origin requests against MeTube instances, enabling limited integrity impact through user-initiated browser interactions.

Affected Products

alexta69 MeTube versions up to 2026.04.09
Component: CORS Policy handler in app/main.py
Fixed version: 2026.04.10

Discovery Timeline

2026-05-01 - CVE-2026-7581 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-7581

Vulnerability Analysis

MeTube is a self-hosted web application that acts as a front-end for yt-dlp, allowing users to download media from various platforms. The vulnerability exists in the on_prepare request handler defined in app/main.py. This handler configured CORS response headers in a way that allowed requests from untrusted domains without validation against an allow-list.

When a victim with an authenticated MeTube session visits a malicious page, the attacker's JavaScript can issue cross-origin requests to the MeTube backend. The browser includes credentials, and the permissive CORS response permits the attacker to read responses or trigger actions. User interaction is required, since the victim must visit attacker-controlled content. The vulnerability is mapped to CWE-346: Origin Validation Error.

Root Cause

The root cause is the absence of an origin allow-list in the on_prepare CORS handler. The application returned permissive Access-Control-Allow-Origin values without checking the request's Origin header against a configured set of trusted domains. The patch introduces a new CORS_ALLOWED_ORIGINS configuration option, defaulting to an empty value, so administrators must explicitly declare which origins may interact with the API.

Attack Vector

The attack is conducted remotely over the network and requires user interaction. An attacker hosts a malicious page that issues fetch or XMLHttpRequest calls to a MeTube instance reachable by the victim. Because MeTube echoed permissive CORS headers, the victim's browser allowed cross-origin reads and state-changing requests. Reported impact is limited to integrity, with no direct confidentiality or availability impact in the published CVSS v4.0 metrics.

python

         'YTDL_OPTIONS_PRESETS': '{}',
         'YTDL_OPTIONS_PRESETS_FILE': '',
         'ALLOW_YTDL_OPTIONS_OVERRIDES': 'false',
+        'CORS_ALLOWED_ORIGINS': '',
         'ROBOTS_TXT': '',
         'HOST': '0.0.0.0',
         'PORT': '8081',
# Source: https://github.com/alexta69/metube/commit/0072d3488ae5b8d922d3ee87458d829993742a32

The patch above introduces the CORS_ALLOWED_ORIGINS setting in app/main.py so operators can constrain which origins the on_prepare handler trusts.

Detection Methods for CVE-2026-7581

Indicators of Compromise

HTTP responses from MeTube containing Access-Control-Allow-Origin headers reflecting arbitrary Origin request values.
Unexpected cross-origin fetch or XHR requests targeting MeTube endpoints such as /add, /delete, or /history.
Browser network logs showing MeTube API calls initiated from third-party domains.

Detection Strategies

Inspect MeTube HTTP responses for permissive CORS headers using a proxy or browser developer tools, and compare against the configured CORS_ALLOWED_ORIGINS value.
Review reverse proxy or web server access logs for requests carrying an Origin header that does not match expected internal hostnames.
Audit deployed MeTube container images and verify the version reported by the running instance is 2026.04.10 or later.

Monitoring Recommendations

Monitor egress traffic from authenticated user sessions for outbound connections to MeTube endpoints originating from unrelated browsing contexts.
Alert on changes to MeTube environment variables, particularly the CORS_ALLOWED_ORIGINS setting in container orchestration manifests.
Track upstream advisories at the GitHub Security Advisory and VulDB Vulnerability Report for new exploitation indicators.

How to Mitigate CVE-2026-7581

Immediate Actions Required

Upgrade MeTube to version 2026.04.10 or later as published in the GitHub Release Notes.
Set the new CORS_ALLOWED_ORIGINS environment variable to an explicit list of trusted origins, never leaving it open to arbitrary domains.
Restrict network exposure of MeTube instances to internal networks or VPNs whenever possible.

Patch Information

The fix is delivered in commit 0072d3488ae5b8d922d3ee87458d829993742a32 and merged via GitHub Pull Request #949. The patch adds the CORS_ALLOWED_ORIGINS configuration option, which the on_prepare handler uses to validate request origins. Administrators should redeploy containers using the 2026.04.10 image and confirm the new variable is populated with sanctioned origins only.

Workarounds

Place MeTube behind a reverse proxy that strips or rewrites Access-Control-Allow-Origin headers and validates the Origin request header against an allow-list.
Require authenticated access through an upstream identity-aware proxy to ensure unauthenticated cross-origin browsers cannot reach the API.
Disable browser-based access to MeTube on shared workstations until the upgrade is deployed.

bash

# Configuration example for docker-compose deploying MeTube 2026.04.10
services:
  metube:
    image: ghcr.io/alexta69/metube:2026.04.10
    environment:
      - CORS_ALLOWED_ORIGINS=https://metube.internal.example.com
      - HOST=0.0.0.0
      - PORT=8081
    ports:
      - "8081:8081"