CVE-2026-54494: Koel SSRF via IPv6 transition address bypass in isPublicHost

Executive brief

Koel, a personal music streaming server, is vulnerable to a security flaw where an attacker can trick the server into accessing internal network resources. By providing a specially crafted podcast feed URL, an authenticated user can bypass security filters and view sensitive data from internal services or cloud metadata endpoints. This could lead to the exposure of private information or cloud credentials that are not intended to be accessible from the internet.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Koel's podcast enclosure processing. The `App\Helpers\Network::isPublicHost()` method uses PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE` and `FILTER_FLAG_NO_RES_RANGE`, which fails to identify IPv6 transition prefixes like NAT64 (64:ff9b::/96) and 6to4 (2002::/16) as private when they embed internal IPv4 addresses. An authenticated attacker can subscribe to a malicious RSS feed with an enclosure URL pointing to these transition addresses. If the host environment supports NAT64 or 6to4 routing, the server will fetch and return the full response body from internal endpoints or cloud instance metadata (IMDS). The vulnerability is patched in version 9.7.1.

Affected products

• phanan koel <= 9.7.0

Timeline

• 2026-06-04: advisory: Initial advisory published on GitHub
• 2026-07-15: patched: Vulnerability fixed in version 9.7.1

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D