PatchSiren cyber security CVE debrief

CVE-2026-108735 miniflux CVE debrief

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. This vulnerability enables attackers to bypass FETCHER_ALLOW_PRIVATE_NETWORKS checks, potentially probing internal ports and sending proxy-style requests to internal services. Defenders should assess exposure and verify compensating controls are in place to mitigate potential impacts. Affected Miniflux instances with authenticated users having feed configuration access are at risk of internal port probing and proxy-style requests to internal services.

Vendor: miniflux
Product: Unknown
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-11
Original CVE updated: 2026-10-11
Advisory published: 2026-10-11
Advisory updated: 2026-10-11

Who should care

Defenders of Miniflux instances with authenticated users having feed configuration access should assess exposure and verify FETCHER_ALLOW_PRIVATE_NETWORKS checks are in place. Security teams and vulnerability management teams should prioritize remediation of affected Miniflux instances and consider compensating controls for internal port probing and proxy-style requests. Operators and administrators of Miniflux instances should review vendor guidance and

Why it matters

CVE-2026-108735 allows authenticated users to reach internal addresses by setting a feed's proxy_url, potentially bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks. Defenders of Miniflux instances with authenticated users having feed configuration access should assess exposure and verify compensating controls.

Authenticated users with feed configuration access may probe internal ports
Internal services may be reachable via proxy-style requests
FETCHER_ALLOW_PRIVATE_NETWORKS checks may be bypassed
Verify compensating controls for internal port probing and proxy-style requests

Technical summary

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can exploit this vulnerability to bypass FETCHER_ALLOW_PRIVATE_NETWORKS checks, potentially probing internal ports and sending proxy-style requests to internal services. This SSRF vulnerability can be mitigated by verifying FETCHER_ALLOW_PRIVATE_NETWORKS checks and implementing compensating controls for internal port probing and proxy-style requests.

Defensive priority

Authenticated users with feed configuration access should be assessed for exposure. Internal port probing and proxy-style requests to internal services may occur. Verify FETCHER_ALLOW_PRIVATE_NETWORKS checks are in place and consider compensating controls.

Recommended defensive actions

Assess exposure of Miniflux instances with authenticated users having feed configuration access
Verify FETCHER_ALLOW_PRIVATE_NETWORKS checks are in place
Consider compensating controls for internal port probing and proxy-style requests
Review vendor guidance for patching or mitigating the vulnerability
Conduct an inventory of affected Miniflux instances and prioritize remediation
Monitor for suspicious activity related to internal port probing and proxy-style requests
Track exceptions and retest remediated assets to ensure vulnerability resolution

Evidence notes

The CVE Program record and NVD vulnerability detail provide official metadata. Supplemental sources include technical descriptions from third-party advisories and additional context from product documentation. The vulnerability details indicate that authenticated users can exploit this SSRF vulnerability to reach internal addresses. Defenders should verify FETCHER_ALLOW_PRIVATE_NETWORKS checks and consider compensating controls for internal port probing and proxy-style requests. The CVE record was published on 2026-10-11T12:19:41.662Z

Sources and references

Verified primary and authoritative sources

CVE-2026-108735 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-108735

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-108735 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108735

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108735.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://hackmd.io/@haind03/miniflux-feed-proxy-url-private-network-bypass

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/reader/fetcher/request_builder.go

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/urllib/url.go

Supplemental source - technical-description
Source reference
Unverified legacy reference

URL: https://github.com/miniflux/v2

Supplemental source - product
Source reference
Unverified legacy reference

URL: https://www.vulncheck.com/advisories/miniflux-2.3.0-through-2.3.3-ssrf-via-per-feed-proxy-url

Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.