Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-95656

CVE-2026-95656: changedetection.io SSRF Vulnerability

CVE-2026-95656 is a server-side request forgery flaw in changedetection.io that enables attackers to manipulate server requests through the Preview Endpoint. This article covers technical details, affected versions, and mitigation.

Published:

CVE-2026-95656 Overview

CVE-2026-95656 is a Server-Side Request Forgery (SSRF) vulnerability in dgtlmoon changedetection.io up to build 50389b07. The flaw resides in the add_watch_ui_snapshot function within changedetectionio/blueprint/add_watch_ui/__init__.py, which handles requests to the Preview Endpoint. Attackers can manipulate the url argument to coerce the server into issuing arbitrary outbound HTTP requests. The exploit has been publicly disclosed, and the issue is classified under CWE-918. Upstream maintainers resolved the issue in version 0.60.1 via commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e.

Critical Impact

Remote unauthenticated attackers can abuse the Preview Endpoint to reach internal services, cloud metadata endpoints, and other network resources otherwise unreachable from the internet.

Affected Products

  • dgtlmoon/changedetection.io versions up to and including build 50389b07
  • The Preview Endpoint component (changedetectionio/blueprint/add_watch_ui/__init__.py)
  • Deployments running any release prior to 0.60.1

Discovery Timeline

  • 2026-09-22 - CVE-2026-95656 published to NVD
  • 2026-09-22 - Last updated in NVD database
  • Patch commit - Fix landed upstream as commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e and released in version 0.60.1

Technical Details for CVE-2026-95656

Vulnerability Analysis

The vulnerability is a classic Server-Side Request Forgery in the add_watch_ui_snapshot handler. This endpoint accepts a user-supplied url parameter and instructs the backend to fetch and render the target for a preview. Because the input is not restricted to safe destinations, attackers can point the fetch at internal IP ranges, loopback services, or cloud metadata APIs. The server then makes the request using its own network position and returns response content or timing information to the attacker. The issue is tracked as CWE-918: Server-Side Request Forgery.

The EPSS estimate for this CVE is 0.511% at the 41.042 percentile as of 2026-09-24, indicating modest but non-trivial exploitation likelihood.

Root Cause

The add_watch_ui_snapshot function performs an outbound HTTP fetch based on attacker-controlled input without applying an allow-list, DNS resolution checks, or IP-range restrictions. Without validation of the destination host, private network space (RFC1918), link-local addresses (169.254.0.0/16), and loopback endpoints remain reachable through the server.

Attack Vector

Exploitation requires only network access to the Preview Endpoint and no authentication or user interaction. An attacker submits a crafted request supplying a url value pointing at an internal service, for example the cloud instance metadata service or an internal admin panel. The server issues the request from its trusted network location and returns the fetched content or measurable side effects to the caller.

python
# Patch snippet from changedetectionio (commit 71d332d5)
# Source: https://github.com/dgtlmoon/changedetection.io/commit/71d332d5a0d3da2a0fe89a392413bf4b7d27c84e
                     all_paused=datastore.data['settings']['application'].get('all_paused', False),
                     all_muted=datastore.data['settings']['application'].get('all_muted', False),
                     llm_configured=bool(_get_llm_config(datastore)),
+                    unread_changes_count=datastore.unread_changes_count,
                     )

     # Monitored websites will not receive a Referer header when a user clicks on an outgoing link.

Additional hardening from the same release restricted favicon responses when the detected MIME type is not an image, reducing the response surface for SSRF-style content smuggling:

python
# Patch snippet from changedetectionio/api/Watch.py (commit 71d332d5)
# Source: https://github.com/dgtlmoon/changedetection.io/commit/71d332d5a0d3da2a0fe89a392413bf4b7d27c84e
             # Use cached MIME type detection
             filepath = os.path.join(watch.data_dir, favicon_filename)
             mime = get_favicon_mime_type(filepath)
+            if 'text' in mime:
+                logger.debug(f"Aborting favicon request for {filepath} because mimetype might be text (bad mimetype) '{mime}'")
+                abort(404)

             response = make_response(send_from_directory(watch.data_dir, favicon_filename))
             response.headers['Content-type'] = mime

Detection Methods for CVE-2026-95656

Indicators of Compromise

  • Requests to /api/add_watch_ui_snapshot or related Preview Endpoint routes containing url parameters pointing to private, loopback, or link-local addresses.
  • Outbound HTTP connections from the changedetection.io host to 169.254.169.254, 127.0.0.1, or internal RFC1918 ranges without operator justification.
  • Unusual spikes in preview or snapshot requests originating from a single source or unauthenticated session.

Detection Strategies

  • Inspect web server and reverse proxy logs for Preview Endpoint requests where the url parameter targets internal hostnames, IP literals, or cloud metadata services.
  • Correlate application access logs with egress network flow logs to identify snapshot requests followed by outbound connections to non-public destinations.
  • Alert on any preview request that returns response bodies containing tokens, credentials, or metadata schema patterns (for example iam/security-credentials).

Monitoring Recommendations

  • Enable egress logging on the changedetection.io host and forward events to a centralized analytics platform such as Singularity Data Lake for correlation with application logs.
  • Deploy network policies that log or block traffic from the application host to metadata endpoints and internal management interfaces.
  • Review changedetection.io audit logs after upgrade to confirm no residual attacker-created watch entries reference internal resources.

How to Mitigate CVE-2026-95656

Immediate Actions Required

  • Upgrade dgtlmoon/changedetection.io to version 0.60.1 or later, which contains commit 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e.
  • Restrict network access to the changedetection.io instance so that only authorized users on trusted networks can reach the Preview Endpoint.
  • Audit existing watch definitions and recent Preview Endpoint requests for URLs pointing to internal infrastructure.

Patch Information

The fix is available upstream in changedetection.io release 0.60.1 and applied in commit 71d332d5. Additional analysis is available in the GitHub CVE SSRF write-up and VulDB entry for CVE-2026-95656.

Workarounds

  • Place the application behind an egress proxy that enforces an allow-list of permitted destination hosts.
  • Use host or container firewall rules to block outbound traffic to 169.254.169.254, loopback interfaces, and internal management subnets.
  • If cloud-hosted, enforce IMDSv2 with a hop limit of 1 to prevent SSRF from retrieving instance metadata credentials.
bash
# Example iptables egress restriction for the changedetection.io host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne