CVE-2026-71246 Details

An authenticated server-side request forgery (SSRF) vulnerability has been identified in Pixelfed's SearchController. This issue arises because the controller accepts URLs through the remote-search parameters and fetches them server-side via the ActivityPubFetchService. The validateUrl() method in this service only blocks specific hosts (127.0.0.1, localhost, and ::1) and requires HTTPS, but it does not check the resolved IP against private, internal, or link-local ranges. Optional DNS validation is disabled by default and, when enabled, only verifies the existence of a DNS record without filtering by IP range. The vulnerability is semi-blind, as the fetch response body is only returned to the requester when the Content-Type matches an ActivityPub content type, making it accessible to any logged-in user.