CVE-2026-27696 - Vulnerability Analysis

Overview

changedetection.io < 0.54.1 contains a server-side request forgery caused by improper URL validation in is_safe_valid_url(), letting authenticated or unauthenticated users fetch internal network URLs and exfiltrate data, exploit requires authentication or no password configured.

Severity & Score

Impact

Attackers can exfiltrate data from internal network services by making the server fetch internal URLs.

Mitigation

Upgrade to version 0.54.1 or later.

References

• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m
• https://github.com/dgtlmoon/changedetection.io/commit/fe7aa38c651d73fe5f41ce09855fa8f97193747b

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-27696 - High (8.6) changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validat... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27696/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner