CVE-2026-47260: Koel Podcast SSRF Vulnerability – Unvalidated Enclosure URLs Enable Internal Data Access

Technical summary

Koel versions prior to 9.3.5 implement SSRF protections at the podcast feed level using the SafeUrl validation rule, which performs DNS resolution and public IP verification. However, this validation is not applied to the <enclosure url=""> fields within the RSS/XML feed content. These enclosure URLs are extracted and stored directly in the database without sanitization. When a user initiates playback of a podcast episode, the Koel server retrieves the full HTTP response from the unvalidated enclosure URL using Http::sink()->get() and streams it to the client. An attacker with legitimate user access can exploit this by hosting a malicious podcast feed containing enclosure URLs targeting internal services (127.0.0.1, private subnets, internal hostnames), effectively turning the Koel server into a proxy for SSRF attacks against the internal network.

Business impact

This vulnerability enables authenticated users to exfiltrate sensitive data from internal services running on the same network as the Koel server, such as databases, configuration services, or internal APIs. In multi-tenant deployments or shared hosting environments, this could expose other customers' data. The attack requires user interaction (clicking play on a crafted episode), but the damage occurs server-side without user visibility. Organizations relying on Koel for music streaming in environments with sensitive internal services face confidentiality risks if internal services expose authentication tokens, configuration data, or other sensitive information via HTTP responses.

Affected systems

Koel versions before 9.3.5 are affected. The vulnerability requires an authenticated user account and the ability to add a podcast feed (or trick an existing user into subscribing to a malicious feed). Desktop installations, server deployments, and containerized instances are all potentially vulnerable if running an affected version. The OpenSSH, Apache, nginx, and other internal services commonly found in corporate networks are potential targets.

Exploitability

Exploitability is straightforward for authenticated attackers. No special privileges, complex exploitation techniques, or user-agent spoofing is required. The attacker simply creates a podcast feed with enclosure URLs pointing to internal services and ensures a user subscribes to it. When the episode is played, the SSRF payload executes automatically. The CVSS score of 7.7 (HIGH) reflects that authentication is required (PR:L), but the scope is changed (S:C), meaning the attacker can access resources beyond the intended scope of the vulnerable component, with high confidentiality impact (C:H). The attack surface expands significantly in environments where users can freely add podcast feeds or where feeds are shared across a community.

Remediation

Upgrade Koel to version 9.3.5 or later. The patch applies the same SafeUrl validation logic to enclosure URLs before storage, ensuring that only feeds containing URLs to public, non-internal IP addresses are accepted. Organizations unable to upgrade immediately should restrict podcast feed addition to trusted administrators only, disable the podcast feature entirely, or implement network-level controls to prevent internal HTTP traffic from Koel instances.

Patch guidance

Apply version 9.3.5 or later as released by the Koel project. Verify the upgrade in your deployment environment and confirm that podcast feeds with internal IP addresses are now rejected. If using containerized deployments, ensure the container image is rebuilt with the patched version. For self-hosted instances, follow the official Koel upgrade documentation for your deployment method (Docker, source installation, etc.). Test functionality with legitimate external podcast feeds post-upgrade to confirm normal operation.

Detection guidance

Monitor Koel server logs and network traffic for indicators of SSRF exploitation: (1) HTTP requests from the Koel process to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) or internal hostnames; (2) Podcast feeds added via the Koel API or UI containing enclosure URLs with internal IP addresses or reserved domain names; (3) Unusual or high-volume podcast feed subscriptions from a single user; (4) Database queries showing enclosure URLs pointing to internal services. Implement egress filtering to block outbound connections from Koel to private networks and monitor for policy violations. Check Koel's podcast feed database table for suspicious URL patterns.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score, the ease of exploitation by any authenticated user, and the potential for reading sensitive internal data. While the KEV catalog does not currently list this vulnerability, the combination of confidentiality impact, broad applicability across Koel installations, and low barrier to entry for attackers (only authentication required, no special privileges) makes it a meaningful risk. Organizations should prioritize patching production Koel instances, particularly those in network segments containing sensitive internal services or databases.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) reflects: Attack Vector = Network (the attacker exploits the vulnerability over the network), Attack Complexity = Low (straightforward podcast feed manipulation), Privileges Required = Low (authentication required but no elevated privileges), User Interaction = None (server-side SSRF occurs without user awareness), Scope = Changed (the attacker can access resources beyond the intended scope—internal services), Confidentiality = High (sensitive data from internal services can be read), Integrity = None (data is only read, not modified), Availability = None (no denial-of-service component). The scope-changed classification is particularly important: it elevates the severity because the attack crosses privilege boundaries.

Frequently asked questions