Is CVE-2026-27696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27696 being exploited in the wild.

How severe is CVE-2026-27696?

Low severity, with a CVSS score of 3.1, published 25 February 2026.

Which products and versions are affected?

changedetection.io (PyPI) ECOSYSTEM:introduced=0,fixed=0.54.1.

Is there a fix for CVE-2026-27696?

Yes. changedetection.io (PyPI): upgrade to 0.54.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27696 attacked?

It is attacked over the network.

Am I affected by CVE-2026-27696?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27696: changedetection.io Server-Side Request Forgery via Watch URLs

CVE-2026-27696 · Severity: low · CVSS 3.1 · Published 2026-02-25

changedetection.io is a web monitoring tool that fetches and tracks changes to web pages. The vulnerability allows unauthenticated users (since no password is set by default) to monitor internal network addresses like 169.254.169.254 (which serves cloud provider credentials), forcing the application to fetch and store sensitive data from internal infrastructure. This enables attackers to exfiltrate secrets, credentials, and other sensitive information without authentication.

Technologies: changedetection.io (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27696 being exploited in the wild.
How severe is CVE-2026-27696?: Low severity, with a CVSS score of 3.1, published 25 February 2026.
Which products and versions are affected?: changedetection.io (PyPI) ECOSYSTEM:introduced=0,fixed=0.54.1.
Is there a fix for CVE-2026-27696?: Yes. changedetection.io (PyPI): upgrade to 0.54.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27696 attacked?: It is attacked over the network.
Am I affected by CVE-2026-27696?: Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

changedetection.io (PyPI): upgrade to 0.54.1 or later
```
pip install "changedetection.io>=0.54.1"
```

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) caused by incomplete URL validation in the is_safe_valid_url() function (changedetectionio/validate_url.py:60–122), which checks only protocol and URL format but performs no IP address validation against private, loopback, or link-local ranges. An attacker can add a watch targeting internal URLs (http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/) via the web UI, REST API, or import API. The application then fetches these URLs server-side without additional validation, stores the full response content, and displays it in the web UI—making this a non-blind, persistent SSRF. No authentication is required by default. The fix is available in version 0.54.1; affected versions are <= 0.53.1.

Affected products

dgtlmoon changedetection.io <= 0.53.1

Identifiers

CVE-2026-27696
GHSA-3c45-4pj5-ch7m
PYSEC-2026-2126

Timeline

2026-02-25: disclosed: GHSA-3c45-4pj5-ch7m published
2026: patched: Fixed in version 0.54.1

References

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.