SSRF (Server-Side Request Forgery) in changedetection-io (CVE-2026-27696)
Summary
SSRF in changedetection-io (CVE-2026-27696). Confidential information can be exposed externally. Exploitable via validators. Mitigation: upgrade to 0.54.1 or later.
Original description
The description as published by the source.
Summary
Changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function is_safe_valid_url() does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs such as:
http://169.254.169.254http://10.0.0.1/http://127.0.0.1/
The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services.
This is particularly severe because:
- The fetched content is stored and viewable - this is not a blind SSRF
- Watches are fetched periodically - creating a persistent SSRF that continuously accesses internal resources
- By default, no password is set - the web UI is accessible without authentication
- Self-hosted deployments typically run on cloud infrastructure where
169.254.169.254returns real IAM credentials
Details
The URL validation function is_safe_valid_url() in changedetectionio/validate_url.py (lines 60–122) validates the URL protocol (http/https/ftp) and format using the validators library, but does not perform any DNS resolution or IP address validation:
# changedetectionio/validate_url.py:60-122
@lru_cache(maxsize=1000)
def is_safe_valid_url(test_url):
safe_protocol_regex = '^(http|https|ftp):'…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-27696 has been found in changedetection-io.
Attackers can target a specific entry point like validators over the network to misuse the product.
Confidential information can be exposed externally.
What to do: upgrade changedetection-io to 0.54.1 or later.
If unsure, ask your IT team or search "changedetection-io CVE-2026-27696" on the vendor's site.
CVE-2026-27696 (changedetection-io) — CWE-918
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: validators / Dockerfile.internal
Patched: 0.54.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
SSRF (CWE-918) exists in changedetection-io. Attackers reach the vulnerable code path via validators without authentication.
Check the vendor advisory for the affected versions of changedetection-io. Attack surface: validators / Dockerfile.internal.
Severity: ?. Confidential information can be exposed externally.
Update to 0.54.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'changedetection-io' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'changedetection-io' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
changedetection-ioを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade changedetection-io to 0.54.1ステージング環境で 0.54.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com