CVE-2026-54493: Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

July 15, 2026

Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel’s radio streaming feature to make the server fetch that URL and return the upstream response body.

This was validated against v9.6.0 (352ea5ec27fa22294da8fb6beacb3d5552f0d09c) using the official phanan/koel:9.6.0 image.

References

github.com/advisories/GHSA-6p96-cfg5-4vhp
github.com/koel/koel/commit/1331f335342b405e60ffabdd60f1f398508f996f
github.com/koel/koel/pull/2545
github.com/koel/koel/releases/tag/v9.7.0
github.com/koel/koel/security/advisories/GHSA-6p96-cfg5-4vhp
nvd.nist.gov/vuln/detail/CVE-2026-54493

Code Behaviors & Features

Detect and mitigate CVE-2026-54493 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →