CVE-2026-54339

Name of the Vulnerable Software and Affected Versions Glean versions prior to 0.2.6

Description An issue exists where the application fails to perform network-level validation on URLs provided in RSS feeds. When a user submits a feed url via the 'POST /api/feeds/discover' endpoint, the system processes it through the discover feed(feed url) function and FeedService.create subscription(), eventually triggering the fetch feed task. This task utilizes fetch feed(feed.url) and parse feed(), which assign links to ParsedEntry.url. Subsequently, fetch and extract fulltext(parsed entry.url) is called without proper validation in backend/packages/rss/glean rss/extractor.py and backend/apps/worker/glean worker/tasks/feed fetcher.py. This allows a malicious feed to trigger a non-blind server-side request forgery (SSRF), enabling the server to request private, loopback, link-local, or cloud-metadata resources. The resulting response is stored in Entry.content and can be accessed via the 'GET /api/entries/{id}' endpoint, potentially exposing internal services, ports, configurations, or cloud metadata access tokens.

Recommendations Update to version 0.2.6.