CVE-2026-55598

Name of the Vulnerable Software and Affected Versions PinePods versions prior to 0.9.0

Description An authenticated user can trigger server-side requests to internal loopback, private-network, and cloud metadata services. This occurs when the system processes an attacker-controlled RSS feed via the 'POST /api/data/add podcast' endpoint. The get podcast values and add episodes functions in rust-api/src/database.rs store the <enclosure url> in Episodes.episodeurl without validating the destination host or IP. Subsequently, the 'POST /api/data/download podcast' endpoint triggers spawn download podcast episode and download episode and wait() in rust-api/src/services/tasks.rs, which performs a GET request to the stored URL. Additionally, the estimate duration from audio url async() function in rust-api/src/database.rs sends an unvalidated HEAD request during feed addition or refresh. Because default redirect following is enabled, external URLs can redirect to internal targets, allowing for internal-service enumeration, disclosure of confidential data, and potential theft of metadata credentials.

Recommendations Update to version 0.9.0.