Executive brief
NewsBlur, a personal news reader and RSS service, is vulnerable to a security flaw where authenticated users can force the server to make unauthorized requests to internal systems. This could allow an attacker to scan the company's private network, access internal-only services, or steal sensitive cloud configuration data. The issue has been resolved in version 14.5.0.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in NewsBlur's 'add_url' endpoint due to insufficient validation of user-supplied URLs. The application fails to filter private IP addresses (RFC 1918) and link-local addresses before the 'feed_fetcher' component attempts to retrieve the content. An authenticated attacker can exploit this by submitting URLs pointing to internal network resources, localhost services, or cloud metadata endpoints (e.g., 169.254.169.254). This can lead to internal port scanning and the exfiltration of sensitive environment data. The fix, introduced in version 14.5.0, implements a 'validate_public_url' check to block non-public IP ranges.
Affected products
- Samuel Clay NewsBlur < 14.5.0
Timeline
- 2026-06-02: patched: Initial patch commit to block private feed fetch URLs
- 2026-06-12: advisory: Release of version 14.5.0
- 2026-06-25: disclosed: CVE published to NVD
References
- https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1
- https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520
- https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0
- https://www.vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint