CVE-2026-77066 omnivore-app CVE debrief

Who should care

Users of the omnivore application, particularly those with administrative access, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review compensating controls, monitor for suspicious activity, and implement vendor-supported updates or mitigations where exposure is confirmed. Vulnerability management and security teams should prioritize patching and review the affected system's configuration to prevent exploitation. Asset inventory and change management processes should be updated to reflect the potential risks associated with this vulnerability. Additionally, security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability may impact organizations with similar application deployments, especially those with exposed administrative interfaces or unauthenticated access to internal endpoints. Therefore, it is crucial for security teams to assess their environment's exposure and implement necessary controls to prevent exploitation. Security teams should also consider implementing monitoring and detection mechanisms to identify potential exploitation attempts. Furthermore, security teams should review their incident response plans to ensure they are prepared to respond to potential security incidents related to this vulnerability. Security teams should also consider conducting a thorough risk assessment to identify potential vulnerabilities and implement necessary controls to mitigate them. Finally, security teams should ensure that their security awareness and training programs are up-to-date and include information about this vulnerability and its potential impact on the organization. The security team should work closely with the IT team to ensure that the necessary patches and updates are applied in a timely manner. The security team should also work with the IT team to implement compensating controls, such as additional monitoring and detection mechanisms, to help prevent exploitation of this vulnerability. The security team should also consider implementing additional security controls, such as network segregation

Technical summary

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields. This vulnerability allows for probing of internal network endpoints through crafted requests, potentially leading to information disclosure.

Defensive priority

Authenticated users may be able to use this vulnerability to probe internal network endpoints through crafted requests.

Recommended defensive actions

• Inventory and review the affected system to identify potential internal endpoints that could be probed.
• Implement address validation for the url parameter in the scanFeedsResolver function.
• Restrict the resolver's access to internal endpoints.
• Monitor for suspicious activity and implement compensating controls.
• Apply the vendor's remediation.

Evidence notes

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields. Evidence is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources