# CVE-2026-108735: Miniflux server-side request forgery via proxy_url

Source: https://junglewise.ai/threats/cve-2026-108735-miniflux-2-3-0-through-2-3-3-contains-a-server-side-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108735 · Severity: medium · CVSS 4.3 · Published 2026-10-11

Miniflux is a minimalist feed reader that fetches and displays RSS/Atom feeds. A vulnerability in versions 2.3.0 through 2.3.3 allows authenticated users to bypass internal network protections by configuring a feed's proxy URL to point to internal hosts, enabling reconnaissance of internal services and potential data exfiltration.

## Quick answers

**Is CVE-2026-108735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108735 being exploited in the wild.

**How severe is CVE-2026-108735?** Medium severity, with a CVSS score of 4.3, published 11 October 2026.

**Which products and versions are affected?** Miniflux 2.3.0 through 2.3.3.

**Is there a fix for CVE-2026-108735?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108735 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108735?** Check whether you run Miniflux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the feed proxy functionality where the proxy_url parameter is insufficiently validated, allowing authenticated attackers to bypass FETCHER_ALLOW_PRIVATE_NETWORKS checks. The vulnerability permits an attacker to point the proxy at loopback (127.0.0.1) or private network addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to probe internal services and send HTTP requests to internal hosts.

## Affected products

- Miniflux Miniflux 2.3.0 through 2.3.3

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/miniflux/v2](https://github.com/miniflux/v2)
- [https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/reader/fetcher/request_builder.go](https://github.com/miniflux/v2/blob/c4d54f87a81b30aa173fddf05d7ff83ae7da5796/internal/reader/fetcher/request_builder.go)

## Related threats

- [Miniflux miniflux-v2 open redirect bypass](https://junglewise.ai/threats/cve-2026-55185-miniflux-miniflux-v2-open-redirect-bypass)