Executive brief
Karakeep, a self-hosted application for saving and managing bookmarks, is vulnerable to a security flaw that allows users to bypass internal network protections. By providing a specially crafted link that redirects to an internal address, an authenticated user can force the server to interact with private services, such as internal databases or search engines, that are not intended to be public. This could lead to the exposure of sensitive internal data or unauthorized access to private infrastructure services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Karakeep due to inconsistent validation of HTTP redirect destinations. While the application validates the initial URL provided by a user to prevent access to internal/private networks, it fails to re-validate subsequent destinations in a redirect chain. An authenticated attacker can exploit this by providing a URL that redirects to internal Docker network services (e.g., Meilisearch on port 7700 or Chrome debugging on port 9222). The flaw affects the crawler and video download worker components, specifically those utilizing Playwright-based processing flows. This allows for unauthorized access to internal APIs and debugging interfaces. The issue is resolved in version 0.32.0.
Affected products
- Karakeep karakeep < 0.32.0
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD