CVE-2026-57575 Details
Description
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Misskey, an open-source federated social media platform, in versions prior to 2026.6.0. The vulnerability arises in the URL preview feature within the UrlPreviewService. Due to inadequate network restrictions before making outbound connections, a remote attacker can manipulate the Misskey server into sending HTTP requests to loopback, private, or link-local services. Although the vulnerability allows for internal requests, it is believed that no sensitive internal data is transmitted back to the attacker, as IP address validation occurs after the request is sent, leading to a rejection of the process.
Users can upgrade to Misskey version 2026.6.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/misskey-dev/misskey/commit/1eac4ccf513a067b9f7b7d123057c09a389fccee | [email protected] | Source CodeVendor |
| https://github.com/misskey-dev/misskey/releases/tag/2026.6.0 | [email protected] | Release NotesVendor |
| https://github.com/misskey-dev/misskey/security/advisories/GHSA-jvcx-f39m-5xrj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Misskey | < 2026.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |