CVE-2026-107449 linuxserver CVE debrief

Who should care

Defenders responsible for Heimdall installations, especially those with publicly accessible endpoints, should assess exposure and prioritize verification of internal host and port scanning risks.

Why it matters

CVE-2026-107449 is a vulnerability in linuxserver Heimdall that allows unauthenticated attackers to force the server to send requests to arbitrary internal hosts and ports. Defenders should prioritize verifying exposure, especially for publicly accessible endpoints, and assess potential internal host and port scanning risks.

• Potential internal host and port scanning
• Partial response data disclosure
• Verification of exposure and impact required

Technical summary

The vulnerability is caused by the lack of IP address restrictions in the GuzzleHttp client used by SupportedApps::execute() in Heimdall through version 2.8.3. This allows an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports, potentially leading to partial response data disclosure. Heimdall's SafeUrlFetcher SSRF protection mechanism is only applied to ItemController, leaving the enhanced-application test and live-stats requests via SupportedApps::execute() unprotected. In realistic installations where the POST /test_config and GET /get_stats endpoints are accessible through CSRF, an attacker can exploit this to read a status/port oracle and partial response data

Defensive priority

Defenders should prioritize verifying exposure of Heimdall installations, especially those with publicly accessible endpoints, and assess the impact of potential internal host and port scanning.

Recommended defensive actions

• Verify exposure of Heimdall installations, especially those with publicly accessible endpoints
• Assess the impact of potential internal host and port scanning
• Implement compensating controls to restrict access to sensitive endpoints
• Monitor for suspicious activity on Heimdall instances
• Review vendor guidance for Heimdall installations
• Conduct asset inventory of Heimdall instances
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the corpus does not establish versions beyond 2.8.3, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.