Is there a patch available for EUVD-2026-39524?

Yes, a patch is available for EUVD-2026-39524. Update the affected software to the latest version immediately.

NewsBlur EUVD-2026-39524

Q: What is the CVSS score of EUVD-2026-39524?

EUVD-2026-39524 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-56771 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-25 VulnCheck

GHSA-hggv-jxwf-w664

Information Disclosure SSRF Newsblur

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network endpoint requires low-privilege auth; scope changes to subsequent cloud systems where high confidentiality impact arises from IAM credential exposure via metadata service.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 19:00 vuln.today

Analysis Generated

Jun 25, 2026 - 19:00 vuln.today

DescriptionCVE.org

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.

AnalysisAI

Server-side request forgery in NewsBlur's add_url endpoint allows any authenticated user to direct the server to issue arbitrary HTTP requests to private, loopback, or link-local addresses, including cloud instance metadata services. All NewsBlur deployments prior to version 14.5.0 (CPE: cpe:2.3:a:samuelclay:newsblur) are affected. An attacker with a valid account can supply a URL resolving to 169.254.169.254 or other internal addresses, enabling exfiltration of cloud provider IAM credentials and internal network reconnaissance. No public exploit identified at time of analysis, though patch commits are publicly available on GitHub and document the exact missing validation check.

Technical ContextAI

NewsBlur is a Django-based RSS aggregator available as both a self-hosted open-source deployment and a hosted SaaS service (newsblur.com). The add_url endpoint in apps/reader/views.py accepted user-supplied URLs and forwarded them to UserSubscription.add_subscription and downstream HTTP fetchers across apps/rss_feeds/models.py, page_importer.py, and icon_importer.py using bare requests.get() and urllib.request.urlopen() calls - none of which validated whether the resolved destination fell within RFC1918 private ranges (10.x, 172.16-31.x, 192.168.x), loopback (127.x), or link-local (169.254.x) space. CWE-918 (Server-Side Request Forgery) characterizes exactly this pattern: the application acts as an unintended proxy, bypassing network perimeter controls on behalf of the attacker. The remediation introduces utils/url_safety.py providing validate_public_url() and safe_requests_get(), applied systematically across all four affected modules, and adds a regression test confirming that POST to /reader/add_url with http://169.254.169.254/latest/meta-data/ returns code -1 without invoking the subscription logic.

RemediationAI

Upgrade NewsBlur to version 14.5.0 or later; this version introduces the utils.url_safety module and replaces all unsafe outbound HTTP calls with validate_public_url() and safe_requests_get() across apps/reader/views.py, apps/rss_feeds/models.py, apps/rss_feeds/icon_importer.py, and apps/rss_feeds/page_importer.py. Patch commits are available at https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1 and https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520. If immediate upgrade is not possible, enforce host-level or cloud security-group egress rules blocking outbound connections from the NewsBlur server to 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 127.0.0.0/8; note that this approach requires keeping firewall rules synchronized with cloud provider metadata IP ranges and does not eliminate SSRF against other internal services. For AWS deployments, enforcing IMDSv2 with a hop limit of 1 (--http-put-response-hop-limit 1) prevents server-proxied requests from retrieving instance metadata, though this does not block scanning of other internal addresses. Restricting NewsBlur account registration to trusted users reduces the attacker pool where public signup is enabled.