CVE-2023-27591

Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.

• CWE-200
• CWE-1220

• https://github.com/miniflux/v2/pull/1745Issue Tracking, Patch
• https://github.com/miniflux/v2/releases/tag/2.0.43Release Notes
• https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73vVendor Advisory
• https://miniflux.app/docs/configuration.html#metrics-collectorProduct
• https://github.com/miniflux/v2/pull/1745Issue Tracking, Patch
• https://github.com/miniflux/v2/releases/tag/2.0.43Release Notes
• https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73vVendor Advisory
• https://miniflux.app/docs/configuration.html#metrics-collectorProduct

Published

Mar 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27586CairoSVG is an SVG converter based on Cairo, a 2D graphics l…7.1
• CVE-2023-27587ReadtoMyShoe, a web app that lets users upload articles and …6.5
• CVE-2023-27588Hasura is an open-source product that provides users GraphQL…7.5
• CVE-2023-27589Minio is a Multi-Cloud Object Storage framework. Starting wi…6.5
• CVE-2023-2759A hidden API exists in TapHome's core platform before versio…8.8
• CVE-2023-27590Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2023-27592Miniflux is a feed reader. Since v2.0.25, Miniflux will auto…5.4
• CVE-2023-27593Cilium is a networking, observability, and security solution…5.5
• CVE-2023-27594Cilium is a networking, observability, and security solution…7.3
• CVE-2023-27595Cilium is a networking, observability, and security solution…9.8
• CVE-2023-27596OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-27597OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5