Executive brief
Glean is a self-hosted RSS reader and personal knowledge management tool. The application failed to validate URLs when fetching RSS feed content, allowing an attacker to craft a malicious feed that tricks the server into making requests to internal services, private networks, or cloud metadata endpoints. The responses are then stored and displayed to the user, exposing sensitive internal information like configuration data or access tokens.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the feed discovery and full-text extraction pipeline. The application accepts an attacker-supplied feed_url via POST /api/feeds/discover, parses RSS items without validating extracted URLs, and then fetches each item's link via fetch_and_extract_fulltext() in the background worker without network-level validation. An attacker can craft a malicious RSS feed containing links pointing to private/loopback addresses (127.0.0.1, 10.0.0.0/8), link-local addresses, or cloud metadata endpoints (169.254.169.254). The fetched response is stored in the Entry.content database field and later retrieved via GET /api/entries/{id}, providing non-blind SSRF with full response disclosure. This bypasses perimeter network controls and exposes internal services, configuration, and potentially cloud credentials. The fix in version 0.2.6 introduces a dedicated SSRF-safe HTTP client that validates all resolved IPs against blocklists and pins connections to prevent DNS rebinding and redirect-based bypasses.
Affected products
- Leslie Leung Glean prior to 0.2.6
Timeline
- 2026-09-17: disclosed
- 2026-06-04: patched: Fixed in version 0.2.6