CVE-2026-54491: Koel SSRF in podcast and radio fetch paths

CVE-2026-54491 · Severity: high · CVSS 7.1 · Published 2026-08-19

Koel, a personal music streaming server, is vulnerable to a security flaw that allows authenticated users to force the server to make unauthorized requests to internal network resources. This could allow an attacker to access sensitive internal data, such as cloud infrastructure credentials or private administrative panels, by bypassing existing security filters. The issue stems from an incomplete previous fix that failed to account for malicious web redirects and DNS manipulation.

Technologies: phanan/koel (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54491 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54491 being exploited in the wild.
How severe is CVE-2026-54491?
High severity, with a CVSS score of 7.1, published 19 August 2026.
Which products and versions are affected?
phanan/koel (Packagist) <= 9.7.0, ECOSYSTEM:introduced=0,fixed=9.7.1.
Is there a fix for CVE-2026-54491?
Yes. phanan/koel (Packagist): upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54491 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54491?
Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phanan/koel (Packagist): upgrade to 9.7.1 or later
    composer require phanan/koel:^9.7.1

Technical details

This vulnerability is a systemic SSRF resulting from an incomplete remediation of CVE-2026-47260. While an initial 'isSafeUrl' check was added, most fetchers (including synchronizeEpisodes, getStreamableUrl, and AddRadioStation) lack per-hop redirect validation and IP pinning. An attacker can bypass the point-in-time host check using a 302 redirect to an internal IP or via DNS rebinding (TOCTOU). The vulnerability is reachable via both the native API and Subsonic API. A fix is available in version 9.7.1 which centralizes outbound HTTP requests through a middleware that validates every redirect hop and pins resolved IPs.

Affected products

  • phanan Koel <= 9.7.0

Identifiers

  • CVE-2026-54491
  • GHSA-6qvr-wjmv-v8mm

Timeline

  • 2026-06-04: disclosed: Initial report to vendor
  • 2026-06-04: patched: Version 9.7.1 released
  • 2026-07-15: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.