Is CVE-2026-105154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105154 being exploited in the wild.

How severe is CVE-2026-105154?

Medium severity, with a CVSS score of 6.1, published 11 November 2026.

Which products and versions are affected?

Apache Roller 4.0 through 6.1.6.

Am I affected by CVE-2026-105154?

Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105154: Apache Roller cross-site request forgery in Planet feed administration

CVE-2026-105154 · Severity: medium · CVSS 6.1 · Published 2026-11-11

Apache Roller is a blogging platform with a built-in Planet feed aggregator that collects and publishes content from multiple sources. A cross-site request forgery vulnerability allows an attacker to trick a logged-in administrator into fetching arbitrary URLs—including internal network addresses—and adding them as feed subscriptions. The attacker-controlled content then gets published to the aggregated feed, potentially exposing private information or injecting malicious content.

Technologies: Apache Roller. Vendors: Apache.

Quick answers

Is CVE-2026-105154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105154 being exploited in the wild.
How severe is CVE-2026-105154?: Medium severity, with a CVSS score of 6.1, published 11 November 2026.
Which products and versions are affected?: Apache Roller 4.0 through 6.1.6.
Is there a fix for CVE-2026-105154?: Yes: fixed in Apache Roller 6.1.7 or later. Until then: Disable the Planet aggregator by setting planet.aggregator.enabled=false in roller-custom.properties if the feature is not in use. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105154 attacked?: It is in a web application.
Am I affected by CVE-2026-105154?: Check whether you run Apache Roller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Apache Roller 6.1.7 or later

Disable the Planet aggregator by setting planet.aggregator.enabled=false in roller-custom.properties if the feature is not in use.

Technical details

The Planet subscription add action accepts GET requests and lacks proper CSRF token validation, allowing an unauthenticated attacker to induce a global administrator to trigger the action via a crafted web page. The vulnerable code fetches the supplied URL and publishes any parseable feed content without further authentication. The fix requires POST requests with valid CSRF tokens for all Planet admin changes and disables the aggregator by default.

Affected products

Apache Roller 4.0 through 6.1.6

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.