CVE-2026-112076 alexta69 CVE debrief

Who should care

Defenders responsible for MeTube installations, particularly those using versions up to 2026.09.28, should assess exposure and apply the patch or upgrade to version 2026.09.29. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and applying the patch to prevent potential remote server-side request forgery attacks.

Why it matters

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for remote server-side request forgery attacks.

• Remote server-side request forgery attacks may be launched against vulnerable MeTube installations.
• Defenders should verify exposure and apply the patch or upgrade to prevent potential attacks.
• The vulnerability has a low CVSS score of 2.9, indicating a relatively low severity.

Technical summary

The vulnerability affects the function DownloadQueue.__write_feed_metadata_sync in the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler in alexta69 MeTube up to 2026.09.28, allowing for remote server-side request forgery attacks. The vulnerability has a low CVSS score of 2.9, indicating a relatively low severity. The attack may be launched remotely and is considered difficult to exploit. Upgrading to version 2026.09.29 or applying the patch a3896604540223ecbb8258b41b1d745d62647d16 can resolve the issue.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for remote server-side request forgery attacks.

Recommended defensive actions

• Verify if the system is using a vulnerable version of MeTube and apply the patch (a3896604540223ecbb8258b41b1d745d62647d16) or upgrade to version 2026.09.29.
• Review and restrict access to the affected component (Feed-metadata Thumbnail Fetch Handler) to prevent exploitation.
• Monitor for potential remote server-side request forgery attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and patch information. The vulnerability affects MeTube installations up to version 2026.09.28. Defenders should verify exposure and apply the patch or upgrade to version 2026.09.29. The patch name is a3896604540223ecbb8258b41b1d745d62647d16. Evidence is based on CVE and NVD entries, which may have limited detail. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.