SZB-b1f10ba752
PinePods CVE-2026-55598 (CVSS 9.1) lets authenticated users subscribe to attacker-controlled RSS feeds
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- PinePods
- Product
- PinePods
- First seen
Summary
TheHackerWire reports CVE-2026-55598, a critical (CVSS 9.1) flaw in PinePods versions before 0.9.0. An authenticated user can subscribe to an attacker-controlled RSS feed through the add_podcast API endpoint.
If you use PinePods
Upgrade PinePods to version 0.9.0 or later
Restrict account registration on self-hosted instances
Review subscribed podcast feeds for unexpected sources
What the sources say 1
· Mastodon: “Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`.” Source