CVE-2026-34577 - Vulnerability Analysis

Overview

Postiz < 2.21.3 contains a server side request forgery caused by insufficient validation of the url parameter in GET /public/stream, letting unauthenticated attackers read internal network resources, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can read internal network and cloud metadata responses, potentially exposing sensitive internal information.

Mitigation

Update to version 2.21.3 or later.

References

• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 3, 2026

🟠 CVE-2026-34577 - High (8.6) Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is ur... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34577/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner