CVE-2026-42346 Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU Time-of-Check-Time-of-Use vulnerability: isSafePublicHttpsUrl resolves DNS to validate the target IP, but subsequent fetch calls...

PT-2026-39214

Name of the Vulnerable Software and Affected Versions Postiz versions 2.16.6 through 2.21.6 Description Postiz is an AI social media scheduling tool. A Time-of-Check-Time-of-Use TOCTOU issue exists where the isSafePublicHttpsUrl function resolves DNS to validate the target IP, but subsequent fetc...