Postiz CVE-2026-42346
MEDIUMSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
AC:H reflects mandatory DNS infrastructure control and timing precision; PR:N as URL endpoints are unauthenticated per CVSS; C:H for potential internal metadata credential access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4-v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
AnalysisAI
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: isSafePublicHttpsUrl() validates an IP via one DNS resolution, but the subsequent fetch() call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Technical ContextAI
Postiz (CPE: cpe:2.3:a:gitroomhq:postiz-app) is a NestJS-based backend that accepts user-supplied URLs across multiple endpoints - image proxying, public controller routes, and storage provider integrations. The CWE-918 (Server-Side Request Forgery) root cause is a classic TOCTOU race: the security check (isSafePublicHttpsUrl) and the dangerous action (fetch) each trigger independent operating-system DNS resolutions. DNS TTLs can be set to zero, enabling an attacker-controlled authoritative DNS server to serve different A records within milliseconds - a technique known as DNS rebinding. The fix in v2.21.7 introduces ssrfSafeDispatcher, a custom undici Agent that overrides the connect.lookup hook to pin DNS resolution: every resolved IP is immediately validated against isBlockedIp() by the same callback that hands the address to the TCP stack, so no second resolution occurs. The diff shows the dispatcher was applied to public.controller.ts, public.integrations.controller.ts, cloudflare.storage.ts, and local.storage.ts.
RemediationAI
Upgrade Postiz to version 2.21.7, confirmed by the official release tag at https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 and fixing commit https://github.com/gitroomhq/postiz-app/commit/071143dcb01cdeb9d5d7019892f4c6ff7b19dbeb. If immediate upgrade is not feasible, configure outbound egress firewall rules on the Postiz backend host to block TCP connections to RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local ranges (169.254.0.0/16) - this eliminates the most impactful SSRF targets (cloud metadata services) without changing application behavior, though it does not fix the TOCTOU flaw and may break legitimate internal integrations. A second compensating control is restricting the Postiz backend to use only a DNS resolver that blocks private-IP responses (DNS RPZ or a split-horizon resolver configured to NXDOMAIN internal ranges), which raises the bar for DNS rebinding but requires DNS infrastructure control and does not eliminate the race window entirely. Neither workaround is a substitute for patching.
More in Postiz App
View allPrivilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated us
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 throug
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to up
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote atta
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks point
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a va
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today