CVE-2026-72597

Executive Summary

CVE-2026-72597 is a server-side request forgery (SSRF) vulnerability in Friendica, a federated social networking platform written in PHP. The flaw exists in the link-preview endpoint, which permits authenticated users with a free self-registered account to submit arbitrary URLs that are fetched server-side without an internal IP deny list being applied. Successful exploitation allows a low-privileged attacker to probe internal network services, including cloud metadata endpoints (e.g., the AWS IMDS at 169.254.169.254), potentially leaking cloud credentials or internal infrastructure details. The vulnerability carries a CVSS score of 6.5 (HIGH confidentiality impact, no integrity or availability impact) and is currently unpatched.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery). The link-preview functionality is a common feature in social platforms: when a user pastes a URL into a post, the server fetches that URL server-side to retrieve metadata (page title, description, images) for rendering a "link preview" card. Traditionally this is implemented by making an outbound HTTP request from the application server to the user-supplied URL.

In this specific case, the NVD description states that the endpoint "fetches any user-supplied URL without applying an internal IP deny list." This indicates the application does not perform server-side validation to block requests to:

• RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local addresses (169.254.0.0/16, which includes cloud metadata services)
• Loopback addresses (127.0.0.0/8)
• IPv6 equivalents (::1, fc00::/7, fe80::/10)

The attack surface is the link-preview endpoint, accessible to any authenticated user — critically, including users with "a free self-registered account." This means the attacker does not need to compromise an existing administrator account or have any elevated privileges. On publicly-facing Friendica instances where self-registration is enabled (a common default for open federation), any internet user can create an account and immediately reach the vulnerable endpoint.

The authentication requirement (PR:L) explains the CVSS score of 6.5 rather than the 9.8 typical of unauthenticated SSRF. The confidentiality impact is rated HIGH because the attacker can read responses from internal services — such as retrieving the full contents of cloud metadata endpoints or reading headers/bodies from internal web applications. The integrity and availability impacts are NONE because the vulnerability is strictly a read/scan primitive; the attacker cannot send arbitrary data to internal services (a limitation of most HTTP GET-based link-preview fetchers).

The exact code path in Friendica is not publicly documented, and the NVD description does not specify function names or file paths. Insufficient technical detail is available to identify the precise implementation. However, the mechanism is consistent with a controller method that accepts a URL parameter, passes it directly to a cURL or stream-based HTTP client without filtering, and returns the fetched content (or derived metadata) to the calling user.

Affected Versions and Patch Status

The NVD description explicitly states the vulnerability exists "through the 2026.08-dev branch." No patched version exists. The patch confidence score of 0/4 means no official vendor advisory, commit, or release addresses this issue. This is a zero-day unpatched vulnerability. Organizations running Friendica must assume they are vulnerable regardless of version.

Exploitation Scenarios

No public exploit or PoC is available. The attack chain below is inferred from the vulnerability class and the NVD description. No function names, endpoint paths, or parameter names are invented — the only endpoint mentioned in the description is the "link-preview endpoint."

Step 1: Reconnaissance and Target Identification

The attacker first identifies Friendica instances with open self-registration. These are typically found via:

• Shodan/Censys searches for the Friendica banner or favicon hash
• Google dorking for "friendica" registration pages
• Monitoring the fediverse for new Friendica pods

The attacker then registers a free account on the target instance, completing any CAPTCHA or email verification required. This satisfies the authentication requirement (PR:L).

Step 2: Triggering the Vulnerability

Once authenticated, the attacker navigates to the link-preview endpoint — the same feature used when composing posts that contain URLs. Instead of a legitimate external URL, the attacker supplies an internal address. Example payloads at the vulnerability-class level:

• http://127.0.0.1:3306 — probe local MySQL port
• http://10.0.0.1:8080 — probe internal application
• http://169.254.169.254/latest/meta-data/ — AWS cloud metadata service
• http://169.254.169.254/metadata/instance?api-version=2021-02-01 — Azure IMDS (no authentication header)
• http://[::1]:80 — IPv6 loopback

Because the endpoint fetches any user-supplied URL without an internal IP deny list, the server resolves and connects to these addresses.

Step 3: Payload Execution

The server-side fetcher performs an HTTP GET to the internal address. If the internal service responds, the link-preview logic parses the response. Depending on how the application renders previews and what it stores/logs, the attacker learns:

• Port scanning: By sending URLs with different ports and observing timing/error differences (connection refused vs. timeout vs. HTTP response parsed), the attacker maps open ports on internal hosts.
• Content exfiltration: If the link-preview feature stores the fetched title/description (common in social platforms), the attacker can retrieve the first bytes of internal service responses through the rendered preview. Cloud metadata endpoints (e.g., AWS IMDSv1) return plain-text responses that fit entirely in the title/description fields. An attacker can exfiltrate the full IAM role credentials (AccessKeyId, SecretAccessKey, Token) by fetching the metadata endpoint's iam/security-credentials/ path.
• Service fingerprinting: Distinct behavior of internal services (HTTP headers, response bodies, error pages) reveals the software and version running internally.

Step 4: Post-Exploitation Impact

With cloud metadata credentials exfiltrated, the attacker can assume the privileges of the instance's IAM role. Alternatively, the SSRF can reach internal admin panels (e.g., Redis, Elasticsearch, Kubernetes API server, internal CI/CD) to extract secrets or stage further attacks behind the perimeter. Since the attacker is already authenticated as a legitimate user, their actions blend with normal traffic.

Impact Assessment

Confidentiality (HIGH): The core impact is information disclosure. An attacker can read responses from internal network services and cloud metadata endpoints. Cloud credential theft is the most severe outcome, potentially granting the attacker access to the entire cloud account associated with the compromised instance's role.

Integrity (NONE): The vulnerability does not allow data modification. However, if the link-preview fetcher supports POST or redirect-following with custom methods, there may be edge cases, but these are not present in the NVD description and are not claimed here.

Availability (NONE): No denial-of-service impact is described.

Affected Systems: Any Friendica instance publicly exposed with self-registration enabled. The default Friendica configuration encourages open federation, making most public instances vulnerable. Instances behind a corporate firewall are less exposed but still at risk if reachable from the internet.

Blast Radius: The blast radius extends beyond the Friendica application itself. The internal network behind the Friendica server becomes the attack surface. In cloud-deployed instances, the metadata service at 169.254.169.254 is directly reachable, making cloud credential theft trivial. On-premises deployments expose internal infrastructure to authenticated external attackers.

CVSS Subscore Notes: The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N computes to 6.5. The low privileges required (PR:L), high confidentiality impact, and no user interaction combine to a moderately severe score. The EPSS score of 0.00201 (10.2nd percentile) indicates low current exploitation probability, but this reflects the recent publication of the CVE, not inherent difficulty of exploitation.

Detection Guidance

Sigma Rule

title: Friendica Link-Preview SSRF - Internal IP Access
id: 75b0fc1c-2f61-4b7a-9e3d-1a2b3c4d5e6f
status: experimental
description: Detects requests to internal IP ranges from Friendica link-preview functionality
author: Valtersit Threat Intelligence
date: 2026/08/15
logsource:
  category: webserver
  product: apache
  detection:
    selection_url:
      cs-method: GET
      cs-uri-query|contains:
        - '169.254.169.254'
        - 'metadata'
        - '10.'
        - '192.168.'
        - '172.16.'
        - '172.17.'
        - '172.18.'
        - '172.19.'
        - '172.2'
        - '127.0.0.1'
        - 'localhost'
    selection_response:
      sc-status: 200
    condition: selection_url and selection_response
    timeframe: 5m
  level: high
  tags:
    - attack.t1190
    - attack.t1090
    - cve.2026.72597
    - cwe.918
    - ssrf
  falsepositives:
    - Legitimate link-preview of internal URLs by administrators (rare)
  fields:
    - c-ip
    - cs-uri-query
    - cs-host

YARA Rule

rule Friendica_SSRF_LinkPreview
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SSRF probes targeting the Friendica link-preview endpoint"
        cve = "CVE-2026-72597"
        date = "2026-08-15"
        threat_severity = "high"

    strings:
        $link_preview = "link-preview" ascii wide nocase
        $aws_meta = "169.254.169.254" ascii wide
        $gcp_meta = "metadata.google.internal" ascii wide nocase
        $localhost = "localhost" ascii wide nocase
        $private_ip1 = "10.0." ascii wide
        $private_ip2 = "192.168." ascii wide
        $private_ip3 = "172.16." ascii wide
        $private_ip4 = "172.17." ascii wide
        $private_ip5 = "172.18." ascii wide
        $private_ip6 = "172.19." ascii wide
        $loopback = "127.0.0.1" ascii wide

    condition:
        $link_preview and
        (
            $aws_meta or $gcp_meta or $localhost or
            $private_ip1 or $private_ip2 or $private_ip3 or
            $private_ip4 or $private_ip5 or $private_ip6 or
            $loopback
        )
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-72597 Friendica Link-Preview SSRF - Internal IP Access";
    flow:established,to_server;
    http.uri;
    content:"link-preview";
    pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3})/i";
    sid:202672597;
    rev:1;
    metadata:cve CVE-2026-72597, cwe CWE-918, tactic T1190;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72597;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "network" and network.protocol == "http" and
    http.request.uri contains "link-preview" and
    (
      http.request.uri contains "169.254.169.254" or
      http.request.uri contains "127.0.0.1" or
      http.request.uri contains "localhost" or
      http.request.uri contains "10." or
      http.request.uri contains "192.168." or
      http.request.uri contains "/metadata" or
      http.request.uri matches "172\\.(1[6-9]|2[0-9]|3[01])\\."
    )
  ]
  [ network where event.category == "network" and network.protocol == "http" and http.response.status_code == 200 and
    destination.ip == "169.254.169.254" or destination.ip == "127.0.0.1" or destination.ip startsWith "10." or
    destination.ip startsWith "192.168." or destination.ip startsWith "172.16." or destination.ip startsWith "172.17." or
    destination.ip startsWith "172.18." or destination.ip startsWith "172.19." or destination.ip startsWith "172.2"
  ]

Splunk SPL Query

index=web earliest=-60m
  (uri="*link-preview*" AND
   (uri="*169.254.169.254*" OR uri="*127.0.0.1*" OR uri="*localhost*" OR
    uri="*10.*" OR uri="*192.168.*" OR uri="*172.16.*" OR uri="*172.17.*" OR
    uri="*172.18.*" OR uri="*172.19.*" OR uri="*172.2*" OR uri="*metadata*"))
| stats count by src_ip, uri, dest_host, status
| where status=200
| sort -count
| eval alert="Friendica SSRF CVE-2026-72597"
| table _time, src_ip, dest_host, uri, status, count, alert

Wazuh OSSEC Rule

<group name="friendica,">
  <rule id="100297" level="14">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">link-preview.*(169\.254\.169\.254|127\.0\.0\.1|localhost|metadata|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3})</field>
    <description>Possible SSRF attempt via Friendica link-preview targeting internal IP (CVE-2026-72597)</description>
    <mitre>
      <id>T1190</id>
      <id>T1090</id>
    </mitre>
    <group>ssrf,cve-2026-72597,cwe-918,</group>
    <alert>
      <as>SECURITY_ALERT</as>
    </alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: No patch is available. The vendor has not released a fix, and there is no evidence of a patched version in any tracked source (patch confidence 0/4). Do not wait for an official update to be issued before taking action.

Immediate Mitigations (1-7 days)

1. Disable self-registration: In the Friendica admin panel, disable open registration. Restrict new account creation to invitation-only or admin-approved. This removes the unauthenticated/anonymous attack vector and raises the bar to requiring a trusted account. This is the single most effective mitigation given the CVSS prerequisite of an authenticated user.
2. Restrict egress traffic with firewall rules: At the host or network firewall, block all outbound traffic from the Friendica application server to private IP ranges (RFC 1918, link-local, loopback). Configure iptables or cloud security groups to deny:
   • 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
   • 169.254.0.0/16 (including cloud metadata service)
   • 127.0.0.0/8
   • IPv6: ::1, fc00::/7, fe80::/10 This blocks the SSRF at the network layer regardless of application logic flaws.
3. Proxy application outbound traffic: Route all outbound HTTP requests from Friendica through an egress HTTP proxy that enforces allow-lists of approved external domains (e.g., only http://, https:// to the public internet blocklist). Configure the proxy to deny private and link-local addresses.
4. Monitor for active exploitation: Since the EPSS score indicates low active exploitation, the priority is detection readiness. Deploy the detection rules from the Detection Guidance section immediately.

Patch / Upgrade Steps

1. Monitor Friendica's official repository, release notes, and security advisories for a patched version. The fix will likely add an internal IP deny list to the link-preview URL validation logic.
2. When a patched version is released, upgrade within 72 hours. Test the upgrade in a staging environment first.
3. Subscribe to Friendica security mailing lists or GitHub watch notifications for the project repository.

Long-Term Hardening (1-3 months)

1. Preserve the firewall egress restriction even after patching — defense in depth.
2. Enable IMDSv2 (AWS) or equivalent strict metadata service options on cloud platforms to require session tokens, making metadata exfiltration harder even if SSRF recurs.
3. Network segmentation: Place Friendica in a separate network segment from sensitive internal services. Restrict outbound access to only essential services (database, cache, mail) at the host firewall level.
4. Periodic SSRF testing: Include SSRF checks in your application security testing pipeline. Deploy a web application firewall (WAF) rule blocking requests to private IP ranges in URL parameters.
5. Review all outbound URL-fetching features in the application for similar SSRF potential, including any feed ingestion, avatar fetching, or OpenGraph preview logic.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72597 — Official CVE record with NVD description, CVSS vector, and CWE classification.
2. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique, relevant to this SSRF as an entry point into internal networks.
3. OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server-Side_Request_Forgery_Prevention_Cheat_Sheet.html — Industry guidance on mitigating SSRF, applicable to the Friendica link-preview flaw.
4. Friendica Project Repository: https://github.com/friendica/friendica — Source repository; monitor for security fixes and the 2026.08 branch updates.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Listed as NOT in KEV as of this report; monitor for updates as exploitation may emerge.

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-72597 as of the writing of this report. The EPSS score of 0.00201 (10.2nd percentile) indicates low current exploitation likelihood.