CVE-2026-42346
Last modified
CVE-2026-42346 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-42346?
How severe is CVE-2026-42346?
How do I fix CVE-2026-42346?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4234A security flaw has been discovered in SSCMS 7.4.0. This vul…6.3
- CVE-2026-42341FOSSBilling is a free, open-source billing and client manage…9.2
- CVE-2026-42342React Router is a router for React. In versions 7.0.0 throug…7.5
- CVE-2026-42343FastGPT is an AI Agent building platform. In versions 4.14.1…6.3
- CVE-2026-42344FastGPT is an AI Agent building platform. In versions 4.14.1…6.3
- CVE-2026-42345FastGPT is an AI Agent building platform. In versions 4.14.1…7.7
- CVE-2026-42347Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-42348OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelem…7.5
- CVE-2026-42349Clerk JavaScript is the official JavaScript repository for C…8.1
- CVE-2026-4235A weakness has been identified in itsourcecode Online Enroll…7.3
- CVE-2026-42350Kargo manages and automates the promotion of software artifa…5.1
- CVE-2026-42351pygeoapi is a Python server implementation of the OGC API su…7.5
Are you affected by CVE-2026-42346?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST