Glean
Monthly
Server-side request forgery in the self-hosted Glean RSS reader (all versions prior to 0.2.6) allows an authenticated user to make the backend worker issue HTTP requests to attacker-chosen URLs, including loopback, RFC 1918 private-range, link-local and cloud metadata endpoints such as 169.254.169.254. Because the fetched response is written into Entry.content and can be read back through GET /api/entries/{id}, this is a non-blind SSRF with full response disclosure rather than a timing or error oracle. Exploitation requires a valid Glean account able to reach POST /api/feeds/discover (PR:L) and no user interaction, so the limiting factor is authentication plus the server's own network reachability; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).
Server-side request forgery in the self-hosted Glean RSS reader (all versions prior to 0.2.6) allows an authenticated user to make the backend worker issue HTTP requests to attacker-chosen URLs, including loopback, RFC 1918 private-range, link-local and cloud metadata endpoints such as 169.254.169.254. Because the fetched response is written into Entry.content and can be read back through GET /api/entries/{id}, this is a non-blind SSRF with full response disclosure rather than a timing or error oracle. Exploitation requires a valid Glean account able to reach POST /api/feeds/discover (PR:L) and no user interaction, so the limiting factor is authentication plus the server's own network reachability; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing).