CVE-2026-57575

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2026.6.0

Description Misskey contains a Server-Side Request Forgery (SSRF) in the URL preview functionality within the UrlPreviewService. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the server to initiate HTTP requests to loopback, private, or link-local services. Since IP address validation occurs after the request is sent and the process is then rejected, sensitive internal data is not believed to be exposed.

Recommendations Update to version 2026.6.0.