CVE-2026-59101 EstrellaXD CVE debrief

Who should care

Security teams and administrators responsible for AutoBangumi deployments should be aware of this vulnerability. Given the medium CVSS score of 6.9, this issue may not be critical for all environments but still poses a risk, especially in scenarios where internal network probing could lead to further exploitation or information disclosure.

Technical summary

The CVE-2026-59101 vulnerability in AutoBangumi before version 3.2.8 allows unauthenticated attackers to perform server-side request forgery (SSRF) attacks. This is possible through the unprotected POST /api/v1/setup/test-downloader endpoint used during initial setup. By providing arbitrary host values, attackers can cause the server to make HTTP GET requests to internal or reserved addresses. The vulnerability's CVSS score is 6.9, classified as Medium severity. Successful exploitation could lead to information leakage about internal network services through error messages.

Defensive priority

Medium priority should be given to patching this vulnerability, especially in environments where AutoBangumi is exposed to untrusted networks or users. The risk of internal network probing and potential subsequent attacks warrants prompt attention.

Recommended defensive actions

• Apply the patch: Upgrade AutoBangumi to version 3.2.8 or later to fix the SSRF vulnerability.
• Limit exposure: Restrict access to the setup endpoint, if possible, until the patch is applied.
• Monitor for suspicious activity: Keep an eye on logs for unusual requests to internal services, which could indicate attempted exploitation.
• Inventory and verify: Ensure all AutoBangumi instances are identified and verified to be running a patched version.
• Perform vulnerability scanning: Conduct regular scans to detect any AutoBangumi instances that may still be vulnerable.
• Implement network segmentation: Isolate critical internal services to limit the potential impact of a successful SSRF attack.
• Review and update incident response plans: Ensure that response plans include procedures for handling potential SSRF attacks and data leaks.

Evidence notes

The CVE record was published on 2026-07-02T20:17:08.507Z and was last modified on 2026-07-07T18:16:40.140Z. The NVD entry is currently Deferred. Multiple sources, including Vulncheck and GitHub, provide details about the vulnerability and the fix in version 3.2.8.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.