Stringer EUVD-2026-88400

Requires an authenticated Stringer account; exploitation by low-privileged users is possible only when self-service signup (Setting::UserSignup) is enabled, otherwise an admin-created account is needed. The attacker must be able to add or import a feed whose URL is attacker-controlled. Highest impact (IAM credential theft) requires Stringer to be deployed on a cloud instance with an attached IAM role reachable via the metadata endpoint (e.g., AWS IMDSv1); without such a deployment the impact is limited to internal port/service scanning against localhost and the private network. Affected versions are all releases prior to commit 75cb095.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) reflects a network-reachable, low-complexity SSRF that requires only a low-privileged authenticated account - realistic when self-service signup (Setting::UserSignup) is enabled, which effectively lowers the auth barrier toward anonymous. No EPSS score, KEV listing, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation despite the plausible-and-serious IMDS credential-theft impact. The absence of EPSS/KEV signals combined with the product being an obscure self-hosted RSS reader means real-world targeting is low, so this reads as a legitimate but low-priority issue rather than a widespread emergency. The classic SSRF-to-cloud-metadata chain (169.254.169.254) is well understood and easily weaponizable in principle, so environments running Stringer on AWS with an instance role should treat the patch as important even though no in-the-wild activity is reported. The C:H rating is driven by the IAM credential-theft scenario; I/A:L reflect limited write/DoS potential via internal request forgery.

An attacker registers a low-privileged account (trivial when self-service signup is enabled) and adds an RSS feed whose URL points at an internal service or the AWS metadata endpoint http://169.254.169.254/latest/meta-data/iam/security-credentials/. The Stringer server fetches that URL via HTTParty/Feedbag with no scheme or private-IP validation, returning internal responses or IAM credentials to the attacker. No public exploit code is identified, but the technique is standard and the fix diff publicly documents the vulnerable fetch paths.