CVE-2026-27797

Published: Mar 7, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.

Affected (1)

Products: Homarr: Homarr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Homarr Homarr	Before 1.54.0

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://github.com/homarr-labs/homarr/commit/fce970c70653f200ff1c73081139a77f0379bd91

Source: security-advisories@github.com

Patch

https://github.com/homarr-labs/homarr/releases/tag/v1.54.0

Source: security-advisories@github.com

Release Notes

https://github.com/homarr-labs/homarr/security/advisories/GHSA-vwqf-2f4m-2cq2

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.