CVE-2026-50552: Koel SSRF Vulnerability in Radio Station Creation

Technical summary

CVE-2026-50552 is a Server-Side Request Forgery (SSRF) vulnerability in Koel's radio station creation endpoint (POST /api/radio/stations). The vulnerability stems from improper validation field configuration: the url parameter validation rules lack the `bail` keyword, causing the HasAudioContentType validation rule to execute even after the SafeUrl rule rejects a URL as pointing to private or reserved addresses. Because validation continues after rejection, the HasAudioContentType rule—which issues HTTP HEAD/GET requests to verify audio content—still fires against internal hosts that should have been blocked. An authenticated non-admin user can exploit this to enumerate or interact with internal network services. Fixed in version 9.7.1.

Business impact

This vulnerability enables authenticated attackers to map internal network topology and discover services not intended to be exposed. While the attacker cannot directly exfiltrate data through the SSRF channel, they can learn about internal systems, ports, and service availability. In environments where Koel is deployed with network access to sensitive internal services (databases, admin panels, internal APIs), this reconnaissance capability becomes a stepping stone for further attacks. Organizations using Koel should prioritize patching to prevent credential-less internal reconnaissance.

Affected systems

Koel versions prior to 9.7.1 are vulnerable. The issue affects any deployment where authenticated (non-admin) users can create radio stations. Self-hosted deployments are most at risk, particularly those with network visibility into internal infrastructure or private address ranges. No vendor-specific product variants are listed in the public advisory data.

Exploitability

Exploitability is moderate. The attack requires valid Koel authentication (non-admin credentials), which is often obtainable if the service permits user registration or if an attacker has compromised a low-privilege account. No user interaction is needed. The attack is network-accessible and does not require special conditions; any authenticated user can immediately attempt SSRF payloads. However, the attacker cannot directly receive response bodies—only verify request success or failure through side channels—which limits what can be directly learned in a single request. This is not yet listed on CISA's KEV catalog.

Remediation

Upgrade Koel to version 9.7.1 or later. The patch corrects the validation rule configuration to prevent the HasAudioContentType check from executing when SafeUrl rejects a URL. Organizations unable to patch immediately should restrict radio station creation to admin users only, or disable the radio feature entirely until a patch is deployed. Additionally, implement network segmentation to limit the Koel server's access to internal resources.

Patch guidance

Verify that your Koel installation is running version 9.7.1 or later by checking the version string in the admin panel or application files. Consult the official Koel repository (https://github.com/koel/koel) or vendor advisory for patch availability and any breaking changes. If using a containerized deployment, pull the latest Koel image tag and redeploy. If self-compiling, fetch version 9.7.1 or the latest stable release from the official source. Restart the Koel service after patching and verify that radio station creation still functions correctly.

Detection guidance

Monitor access logs for POST requests to /api/radio/stations with `url` parameters containing private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, or reserved addresses per RFC 1918). Look for patterns suggesting URL fuzzing or repeated failed validation attempts. Check network egress logs for unexpected outbound HEAD/GET requests from the Koel server to internal hosts, especially to non-standard ports. Enable application-level logging if available to capture rejected SafeUrl validations paired with subsequent HasAudioContentType requests. Alert on any authenticated radio station creation attempts by non-admin users using internal or private addresses.

Why prioritize this

This vulnerability warrants priority patching because it enables reconnaissance of internal infrastructure by any authenticated user, often a weaker security boundary than admin-only access. While the CVSS score is medium (6.3), the practical impact depends on what internal services are reachable from the Koel server. Organizations where Koel runs on a network with access to databases, admin dashboards, or sensitive APIs should patch urgently. For isolated deployments with no internal network access, risk is lower but patching remains recommended to prevent future abuse if the network environment changes.

Risk score, explained

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L yields a score of 6.3 (MEDIUM). Attack Vector is Network (fully remote), Attack Complexity is Low (no special conditions), and Privileges Required is Low (non-admin authentication suffices). The impact is low across confidentiality, integrity, and availability: the attacker can probe internal services and potentially disrupt them or influence cached responses, but cannot directly leak sensitive data or cause widespread denial of service through the SSRF alone. The lack of escalation to higher impact (e.g., remote code execution) or ability to be exploited without authentication keeps the score in the medium range.

Frequently asked questions