Misskey EUVD-2026-43040

The URL preview feature must be enabled and accessible - no special non-default configuration is indicated as required, meaning any Misskey instance with URL preview active (the default) is vulnerable. The CVSS 4.0 vector specifies PR:N and UI:N, confirming exploitation requires neither authentication nor victim interaction - any party that can submit a URL for preview (which may include unauthenticated users or federated actors, depending on instance configuration) can trigger the SSRF. Exploitation is limited by the blind nature of the SSRF: the attacker cannot read HTTP responses from internal targets, restricting impact to side-effect-based attacks against internal services that perform actions on unauthenticated HTTP GET/HEAD requests. Instances where Misskey has no co-located internal services or is isolated via egress controls have negligible residual risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9, reflecting easy remote triggering with no authentication or user interaction required. The subsequent-system integrity impact is rated Low (SI:L) while all other impact dimensions are None, consistent with the vendor's assessment that response data is not exfiltrated. EPSS data is not available in the provided intelligence, preventing probability-of-exploitation quantification. KEV status is absent, and no POC has been identified, making this a medium-priority finding rather than an immediate emergency. The real-world risk depends heavily on what internal services are co-located with Misskey deployments: in cloud environments where metadata endpoints (e.g., 169.254.169.254) or unauthenticated internal APIs are reachable, blind SSRF can still enable privilege escalation or lateral movement even without data exfiltration. The vendor caveat that 'no sensitive data is believed to be exposed' is an inference, not a guarantee - defenders should not rely solely on this claim. Patch availability makes remediation straightforward.

An unauthenticated remote attacker submits a URL pointing to an attacker-controlled domain whose DNS resolves to a private or loopback address (DNS rebinding is not required - a static A record to 192.168.1.1 or 127.0.0.1 suffices). Misskey's UrlPreviewService resolves the name, opens an HTTP connection to the internal target, and dispatches the request before the IP-validation check fires and terminates the process. The internal service receives the request, potentially triggering state changes (e.g., hitting an unauthenticated admin endpoint), even though the HTTP response is not relayed back to the attacker. No public POC has been identified, but the technique is well-understood and requires only a crafted URL submission.