Karakeep EUVD-2026-31826

The attacker must hold a valid Karakeep account on the target instance (CVSS PR:L) and must be able to submit a URL into either the link crawler or the video download ingestion flow - both default-enabled paths. The attacker must control a web server that returns an HTTP 3xx redirect to an internal hostname or IP. Exploitation is meaningfully limited to deployments where reachable internal services exist on the same Docker network or host network namespace as the Karakeep workers; a single-container deployment with no sibling services on a private network has little to steal. No user interaction is required (UI:N), and exploitation is network-reachable end-to-end (AV:N).

Signals are mixed and point to a real but bounded priority. CVSS 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) reflects network-reachable exploitation by a low-privileged authenticated user with no user interaction and high confidentiality impact - consistent with reading internal service responses. SSVC reports exploitation status 'poc' (publicly available exploit code exists), not automatable, with partial technical impact, and EPSS sits at 0.03% (10th percentile) with no CISA KEV listing - so exploitation is feasible but not yet widespread. The realistic threat model is an attacker who already has (or can self-register) a Karakeep account; for public/multi-tenant deployments this is trivial, while single-user self-hosted installs face a much lower exposure. Note one tension worth verifying: PR:L assumes user accounts exist, but some Karakeep instances allow open signup, effectively reducing this to unauthenticated reachability - operators should confirm their signup configuration.

An authenticated Karakeep user adds a bookmark pointing at https://attacker.example/redirect, where the attacker's server responds with a 302 to http://meilisearch:7700/indexes or http://172.17.0.1:9200/_cat/indices. The crawler or video downloader follows the redirect into the Docker bridge network, fetches the internal service's response, and stores fragments of it as scraped metadata that the attacker can read back through the normal bookmark UI. Publicly available exploit code exists per SSVC, so weaponization effort is minimal.