CVE-2026-112076 Details
Description
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.
A server-side request forgery (SSRF) vulnerability has been identified in alexta69 MeTube versions through 2026.09.28. The issue arises in the DownloadQueue.__write_feed_metadata_sync function within the app/ytdl.py file, specifically in the Feed-metadata Thumbnail Fetch Handler component. This vulnerability allows an attacker to manipulate the thumbnail fetching process to access internal services or metadata, such as cloud IAM credentials, by exploiting the application's handling of playlist metadata. The vulnerability can be exploited remotely, but requires the targeted service to be reachable from the MeTube server.
Users are advised to upgrade to MeTube version 2026.09.29, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/alexta69/metube/ | [email protected] | ProductVendor |
| https://github.com/alexta69/metube/commit/a3896604540223ecbb8258b41b1d745d62647d16 | [email protected] | Source CodeVendor |
| https://github.com/alexta69/metube/releases/tag/2026.09.29 | [email protected] | Release NotesVendor |
| https://github.com/alexta69/metube/security/advisories/GHSA-hq22-f7w6-p8cr | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-112076 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1009577 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421755 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421755/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| alexta69 MeTube | <= 2026.09.28 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |