CVE-2026-107449

The linuxserver Heimdall application (through version 2.8.3 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that the SafeUrlFetcher protection is only applied to the ItemController , while the SupportedApps::execute() function uses a GuzzleHttp client without IP address ...

heimdall-unauth-ssrf

Heimdall: Unauthenticated SSRF via testconfig Description...