High severity · published Jun 25, 2026
CVE-2026-56771
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
NewsBlur · samuelclay
before 14.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56771
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56771
github.com
https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1
github.com
https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520
github.com
https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0
www.vulncheck.com
https://www.vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint
More from NewsBlur
4.3
CVE-2026-56772
NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint