Is CVE-2026-18736 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18736 being exploited in the wild.

How severe is CVE-2026-18736?

Medium severity, with a CVSS score of 5, published 3 August 2026.

Is there a fix for CVE-2026-18736?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18736 attacked?

It is attacked over the network.

Am I affected by CVE-2026-18736?

Check whether you run Shlink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18736: Shlink server-side request forgery in title resolution

CVE-2026-18736 · Severity: medium · CVSS 5 · Published 2026-08-03

Shlink is a self-hosted URL shortener that can automatically fetch and display the title of linked web pages. When this feature is enabled, an authenticated user with any API key can trick the server into making requests to internal systems (including private networks and cloud metadata endpoints) and leak sensitive information through the page title returned in the response. This could expose internal service details and credentials stored in cloud metadata.

Technologies: Shlink. Vendors: Shlink.

Quick answers

Is CVE-2026-18736 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18736 being exploited in the wild.
How severe is CVE-2026-18736?: Medium severity, with a CVSS score of 5, published 3 August 2026.
Which products and versions are affected?: Shlink 2.6.0 through 5.1.5.
Is there a fix for CVE-2026-18736?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18736 attacked?: It is attacked over the network.
Am I affected by CVE-2026-18736?: Check whether you run Shlink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability in Shlink's ShortUrlTitleResolutionHelper component. When title auto-resolution is enabled, the application fetches the target URL during short URL creation to extract the HTML title element, with no host-based restrictions or private IP filtering. The vulnerable code in module/Core/src/ShortUrl/Helper/ShortUrlTitleResolutionHelper.php allows any authenticated API key holder to supply arbitrary URLs and the server will follow up to 15 HTTP redirects without validating the destination. An attacker can supply URLs pointing to localhost, link-local addresses (169.254.169.254), or other private network ranges; public redirect chains bypassing URL-only validation are also effective. Extracted page titles are persisted and returned in the API response, enabling information exfiltration. This requires an authenticated API key (any role can create short URLs) and the AUTO_RESOLVE_TITLES feature to be explicitly enabled (off by default). No patch has been released as of the advisory date.

Affected products

Shlink Shlink 2.6.0 through 5.1.5

Timeline

2026-08-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.