CVE-2026-54492: Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

July 15, 2026

Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing.

This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.

This is distinct from GHSA-7j2f-6h2r-6cqc, which fixed unsafe episode enclosure URLs in versions <= 9.3.4. The issue here is a newer validation gap in the Subsonic route itself, still present in v9.6.0.

References

github.com/advisories/GHSA-w79m-f3jx-779v
github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f
github.com/koel/koel/pull/2545
github.com/koel/koel/releases/tag/v9.7.0
github.com/koel/koel/security/advisories/GHSA-w79m-f3jx-779v
nvd.nist.gov/vuln/detail/CVE-2026-54492

Code Behaviors & Features

Detect and mitigate CVE-2026-54492 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →