CVE-2026-42346

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42346", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-26T13:26:14.515Z", "datePublished": "2026-05-08T22:26:50.501Z", "dateUpdated": "2026-05-11T14:35:55.041Z"}, "containers": {"cna": {"title": "Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45"}, {"name": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb", "tags": ["x_refsource_MISC"], "url": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb"}, {"name": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7"}], "affected": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"version": ">= 2.16.6, < 2.21.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T22:26:50.501Z"}, "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4\u2013v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7."}], "source": {"advisory": "GHSA-f7jj-p389-4w45", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T14:35:45.263376Z", "id": "CVE-2026-42346", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T14:35:55.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42346", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T14:35:45.263376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T14:35:50.786Z"}}], "cna": {"title": "Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths", "source": {"advisory": "GHSA-f7jj-p389-4w45", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gitroomhq", "product": "postiz-app", "versions": [{"status": "affected", "version": ">= 2.16.6, < 2.21.7"}]}], "references": [{"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45", "name": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb", "name": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7", "name": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4\u2013v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T22:26:50.501Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42346", "state": "PUBLISHED", "dateUpdated": "2026-05-11T14:35:55.041Z", "dateReserved": "2026-04-26T13:26:14.515Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T22:26:50.501Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "postiz-app", "vendor": "gitroomhq", "versions": [{"status": "affected", "version": ">= 2.16.6, < 2.21.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4\u2013v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7."}, {"lang": "es", "value": "Postiz es una herramienta de programaci\u00f3n de redes sociales con IA. Desde la versi\u00f3n 2.16.6 hasta antes de la versi\u00f3n 2.21.7, todas las protecciones de SSRF a\u00f1adidas en las versiones 2.21.4-2.21.6 comparten una vulnerabilidad TOCTOU (Time-of-Check-Time-of-Use) fundamental: isSafePublicHttpsUrl() resuelve el DNS para validar la IP de destino, pero las llamadas subsiguientes a fetch() resuelven el DNS de forma independiente. Un atacante que controla un servidor DNS puede explotar esta brecha mediante el reencadenamiento de DNS para redirigir las solicitudes a direcciones de red internas. Este problema ha sido parcheado en la versi\u00f3n 2.21.7."}], "id": "CVE-2026-42346", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42346", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T14:35:45.263376Z", "version": "2.0.3"}}]}, "published": "2026-05-08T23:16:37.903", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb"}, {"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-f7jj-p389-4w45"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.16.6,2.21.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "postiz-app", "source": "cna", "vendor": "gitroomhq"}, "product": "postiz-app", "vendor": "gitroomhq"}], "created": "2026-05-08T23:30:15.078773+00:00", "updated": "2026-05-09T00:00:25.460819+00:00", "vendors": ["gitroomhq", "gitroomhq$PRODUCT$postiz-app"]}