# CVE-2026-54492: Koel authenticated blind SSRF in Subsonic podcast creation

Source: https://junglewise.ai/threats/cve-2026-54492-koel-authenticated-blind-ssrf-in-subsonic-podcast-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-54492 · Severity: medium · CVSS 4.3 · Published 2026-08-19

Koel, an open-source personal audio streaming service, is vulnerable to a security flaw in its Subsonic-compatible podcast feature. An authenticated user can trick the server into making unauthorized requests to internal network resources that are normally protected. This could allow an attacker to probe internal services or interact with private systems within the corporate or home network where Koel is hosted.

Technologies: [phanan/koel (Packagist)](https://junglewise.ai/threats/technologies/phanan-koel). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54492 being exploited in the wild.

**How severe is CVE-2026-54492?** Medium severity, with a CVSS score of 4.3, published 19 August 2026.

**Which products and versions are affected?** phanan/koel (Packagist) <= 9.6.0, ECOSYSTEM:introduced=0,fixed=9.7.0.

**Is there a fix for CVE-2026-54492?** Yes. phanan/koel (Packagist): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54492 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54492?** Check whether you run phanan/koel (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phanan/koel (Packagist): upgrade to 9.7.0 or later

  ```sh
  composer require phanan/koel:^9.7.0
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Koel versions up to 9.6.0 due to insufficient validation in the Subsonic-compatible 'createPodcastChannel.view' route. While the primary podcast API uses a 'SafeUrl' validation rule to block private IP ranges, the Subsonic route in 'app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php' only checks for a generic URL string. An authenticated attacker can provide a loopback or internal RFC1918 address, which is then immediately fetched by the 'PodcastService' during the channel creation flow. This allows for internal service discovery and request execution. The issue is addressed in version 9.7.0 by applying the 'SafeUrl' rule to the Subsonic request validator.

## Affected products

- phanan koel <= 9.6.0

## Identifiers

- CVE-2026-54492
- GHSA-w79m-f3jx-779v

## Timeline

- 2026-06-04: disclosed
- 2026-07-15: advisory
- 2026-07-15: patched: Fixed in version 9.7.0

## References

- [https://api.github.com/users/dennyabrahamsinaga](https://api.github.com/users/dennyabrahamsinaga)
- [https://github.com/dennyabrahamsinaga](https://github.com/dennyabrahamsinaga)
- [https://api.github.com/users/dennyabrahamsinaga/gists%7B/gist_id%7D](https://api.github.com/users/dennyabrahamsinaga/gists%7B/gist_id%7D)
- [https://api.github.com/users/dennyabrahamsinaga/repos](https://api.github.com/users/dennyabrahamsinaga/repos)
- [https://avatars.githubusercontent.com/u/62960949?v=4](https://avatars.githubusercontent.com/u/62960949?v=4)
- [https://api.github.com/users/dennyabrahamsinaga/events%7B/privacy%7D](https://api.github.com/users/dennyabrahamsinaga/events%7B/privacy%7D)

## Related threats

- [Koel SSRF via IPv6 transition address bypass in isPublicHost](https://junglewise.ai/threats/cve-2026-54494-koel-ssrf-via-ipv6-transition-address-bypass-in-ispublichost)
- [Koel SSRF in Subsonic Internet Radio Stations](https://junglewise.ai/threats/cve-2026-54493-koel-ssrf-in-subsonic-internet-radio-stations)
- [Koel SSRF in podcast and radio fetch paths](https://junglewise.ai/threats/cve-2026-54491-koel-ssrf-in-podcast-and-radio-fetch-paths)
- [Koel SSRF in Subsonic podcast feed and stream helper](https://junglewise.ai/threats/koel-ssrf-in-subsonic-podcast-feed-and-stream-helper-4a257c9c)
- [Koel SSRF in radio station creation endpoint](https://junglewise.ai/threats/cve-2026-50552-koel-ssrf-in-radio-station-creation-endpoint)