CVE-2026-54492: Koel authenticated blind SSRF in Subsonic podcast creation

CVE-2026-54492 · Severity: medium · CVSS 4.3 · Published 2026-08-19

Koel, an open-source personal audio streaming service, is vulnerable to a security flaw in its Subsonic-compatible podcast feature. An authenticated user can trick the server into making unauthorized requests to internal network resources that are normally protected. This could allow an attacker to probe internal services or interact with private systems within the corporate or home network where Koel is hosted.

Technologies: phanan/koel (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54492 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54492 being exploited in the wild.
How severe is CVE-2026-54492?
Medium severity, with a CVSS score of 4.3, published 19 August 2026.
Which products and versions are affected?
phanan/koel (Packagist) <= 9.6.0, ECOSYSTEM:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2026-54492?
Yes. phanan/koel (Packagist): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54492 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54492?
Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phanan/koel (Packagist): upgrade to 9.7.0 or later
    composer require phanan/koel:^9.7.0

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Koel versions up to 9.6.0 due to insufficient validation in the Subsonic-compatible 'createPodcastChannel.view' route. While the primary podcast API uses a 'SafeUrl' validation rule to block private IP ranges, the Subsonic route in 'app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php' only checks for a generic URL string. An authenticated attacker can provide a loopback or internal RFC1918 address, which is then immediately fetched by the 'PodcastService' during the channel creation flow. This allows for internal service discovery and request execution. The issue is addressed in version 9.7.0 by applying the 'SafeUrl' rule to the Subsonic request validator.

Affected products

  • phanan koel <= 9.6.0

Identifiers

  • CVE-2026-54492
  • GHSA-w79m-f3jx-779v

Timeline

  • 2026-06-04: disclosed
  • 2026-07-15: advisory
  • 2026-07-15: patched: Fixed in version 9.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.