CVE-2026-25123: medium-severity vulnerability in homarr-labs homarr
Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
homarr-labs · homarrRelated CVEs — homarr-labs homarr
In the same product, most dangerous first.
CVE-2026-27796MEDIUMHomarr: Unauthenticated Information Disclosure (Integration Metadata Leak)EPSS 1.2%CVE-2026-27797MEDIUMHomarr: Unauthenticated SSRF in rssFeed.tsEPSS 0.5%CVE-2026-33510HIGHDOM-Based XSS in Homarr /auth/login RedirectEPSS 0.3%CVE-2025-64759HIGHHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG UploadEPSS 0.3%CVE-2025-67493HIGHHomarr: missing input sanitization and possible privilege escalation through ldap search query injectionEPSS 0.3%CVE-2026-32602MEDIUMHomarr has a Race Condition in Invite Token Registration (TOCTOU)EPSS 0.2%