Executive brief
Linkwarden is a self-hosted tool used by teams to collect and archive webpages. A security flaw allows logged-in users to force the server to make unauthorized requests to internal network services or cloud metadata providers. This could allow an attacker to steal sensitive cloud credentials or access private internal databases that are not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the fetchTitleAndHeaders function within apps/web/lib/shared/fetchTitleAndHeaders.ts. The root cause is insufficient URL validation that only verifies if a string starts with "http://" or "https://", failing to block internal IP ranges or loopback addresses. An authenticated attacker can exploit this by submitting a crafted URL during link creation or via the API, causing the server (or the Puppeteer-based worker) to fetch content from internal services like Docker APIs or cloud metadata endpoints (e.g., 169.254.169.254). This can result in the theft of IAM role credentials in AWS/GCP environments or unauthorized access to internal services like Meilisearch. The issue is fixed in version 2.13.0.
Affected products
- Linkwarden Linkwarden < 2.13.0
Timeline
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-09: disclosed: NVD publication date
- 2026-05-08: patched: Patch availability confirmed in version 2.13.0