CVE-2026-123207: fallo de gravedad baja en LibreSpark LibreTV
LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.3epss 0.2%
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Productos afectados
LibreSpark · LibreTVReferencias
https://github.com/LibreSpark/LibreTV/blob/29cbeb3d37b4876f909a0354087a3531af0447f6/src/lib/ssrf.ts#L56-L85https://github.com/LibreSpark/LibreTV/commit/cb4219368b7f6502387a703ef2a781ba763da2b1https://github.com/LibreSpark/LibreTV/issues/941https://github.com/LibreSpark/LibreTV/pull/960https://github.com/LibreSpark/LibreTV/releases/tag/v2.21.2https://www.vulncheck.com/advisories/libretv-before-2.21.2-ssrf-protection-bypass-via-dns-rebinding