# CVE-2026-54491: Koel SSRF in podcast and radio fetch paths

Source: https://junglewise.ai/threats/cve-2026-54491-koel-ssrf-in-podcast-and-radio-fetch-paths  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-54491 · Severity: high · CVSS 7.1 · Published 2026-08-19

Koel, a personal music streaming server, is vulnerable to a security flaw that allows authenticated users to force the server to make unauthorized requests to internal network resources. This could allow an attacker to access sensitive internal data, such as cloud infrastructure credentials or private administrative panels, by bypassing existing security filters. The issue stems from an incomplete previous fix that failed to account for malicious web redirects and DNS manipulation.

Technologies: [phanan/koel (Packagist)](https://junglewise.ai/threats/technologies/phanan-koel). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54491 being exploited in the wild.

**How severe is CVE-2026-54491?** High severity, with a CVSS score of 7.1, published 19 August 2026.

**Which products and versions are affected?** phanan/koel (Packagist) <= 9.7.0, ECOSYSTEM:introduced=0,fixed=9.7.1.

**Is there a fix for CVE-2026-54491?** Yes. phanan/koel (Packagist): upgrade to 9.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54491 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54491?** Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phanan/koel (Packagist): upgrade to 9.7.1 or later

  ```sh
  composer require phanan/koel:^9.7.1
  ```


## Technical details

This vulnerability is a systemic SSRF resulting from an incomplete remediation of CVE-2026-47260. While an initial 'isSafeUrl' check was added, most fetchers (including synchronizeEpisodes, getStreamableUrl, and AddRadioStation) lack per-hop redirect validation and IP pinning. An attacker can bypass the point-in-time host check using a 302 redirect to an internal IP or via DNS rebinding (TOCTOU). The vulnerability is reachable via both the native API and Subsonic API. A fix is available in version 9.7.1 which centralizes outbound HTTP requests through a middleware that validates every redirect hop and pins resolved IPs.

## Affected products

- phanan Koel <= 9.7.0

## Identifiers

- CVE-2026-54491
- GHSA-6qvr-wjmv-v8mm

## Timeline

- 2026-06-04: disclosed: Initial report to vendor
- 2026-06-04: patched: Version 9.7.1 released
- 2026-07-15: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/kiffa-australis256](https://api.github.com/users/kiffa-australis256)
- [https://github.com/kiffa-australis256](https://github.com/kiffa-australis256)
- [https://api.github.com/users/kiffa-australis256/gists%7B/gist_id%7D](https://api.github.com/users/kiffa-australis256/gists%7B/gist_id%7D)
- [https://api.github.com/users/kiffa-australis256/repos](https://api.github.com/users/kiffa-australis256/repos)
- [https://avatars.githubusercontent.com/u/289640798?v=4](https://avatars.githubusercontent.com/u/289640798?v=4)
- [https://api.github.com/users/kiffa-australis256/events%7B/privacy%7D](https://api.github.com/users/kiffa-australis256/events%7B/privacy%7D)

## Related threats

- [Koel SSRF via IPv6 transition address bypass in isPublicHost](https://junglewise.ai/threats/cve-2026-54494-koel-ssrf-via-ipv6-transition-address-bypass-in-ispublichost)
- [Koel SSRF in Subsonic Internet Radio Stations](https://junglewise.ai/threats/cve-2026-54493-koel-ssrf-in-subsonic-internet-radio-stations)
- [Koel authenticated blind SSRF in Subsonic podcast creation](https://junglewise.ai/threats/cve-2026-54492-koel-authenticated-blind-ssrf-in-subsonic-podcast-creation)
- [Koel SSRF in Subsonic podcast feed and stream helper](https://junglewise.ai/threats/koel-ssrf-in-subsonic-podcast-feed-and-stream-helper-4a257c9c)
- [Koel SSRF in radio station creation endpoint](https://junglewise.ai/threats/cve-2026-50552-koel-ssrf-in-radio-station-creation-endpoint)