CVE-2026-50552: Koel SSRF in radio station creation endpoint

CVE-2026-50552 · Severity: medium · CVSS 6.3 · Published 2026-06-12

Koel, a personal music streaming server, contains a vulnerability in how it handles the creation of new radio stations. An authenticated user can provide a specially crafted web address that forces the Koel server to make unauthorized requests to internal network resources. This could allow an attacker to discover private internal services or trigger actions on other systems within the corporate network that are not intended to be accessible from the internet.

Technologies: phanan/koel (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-50552 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50552 being exploited in the wild.
How severe is CVE-2026-50552?
Medium severity, with a CVSS score of 6.3, published 12 June 2026.
Which products and versions are affected?
phanan/koel (Packagist) <= 9.7.0, ECOSYSTEM:introduced=0,fixed=9.7.1.
Is there a fix for CVE-2026-50552?
Yes. phanan/koel (Packagist): upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50552 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50552?
Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phanan/koel (Packagist): upgrade to 9.7.1 or later
    composer require phanan/koel:^9.7.1

Technical details

A blind Server-Side Request Forgery (SSRF) exists in the POST /api/radio/stations endpoint of Koel. The vulnerability stems from a missing 'bail' keyword in the validation rules for the 'url' field in RadioStationStoreRequest.php. Because Laravel continues validation even after a rule fails, the HasAudioContentType rule executes and issues HEAD/GET requests to the user-supplied URL even if the SafeUrl rule has already flagged it as a private/reserved address. An authenticated, non-admin attacker can use the resulting error messages as a reachability oracle to perform internal port scanning and host discovery. The issue is addressed in version 9.7.1.

Affected products

  • phanan Koel <= 9.7.0

Identifiers

  • CVE-2026-50552
  • GHSA-jr4p-4xjh-fwvw

Timeline

  • 2026-05-30: disclosed: Vulnerability identified via source review.
  • 2026-06-04: advisory: GitHub Advisory published.
  • 2026-07-15: kev added: Date published in advisory database.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.