CVE-2026-27797: Homarr: Unauthenticated SSRF in rssFeed.ts

Q: What is the severity of CVE-2026-27797?

CVE-2026-27797 has a high severity rating due to the potential for unauthorized external HTTP requests.

Q: How do I fix CVE-2026-27797?

To fix CVE-2026-27797, update Homarr to version 1.54.0 or later.

Q: What type of vulnerability is CVE-2026-27797?

CVE-2026-27797 is categorized as an unauthenticated Server-Side Request Forgery (SSRF) vulnerability.

Q: What can an attacker do with CVE-2026-27797?

An attacker can exploit CVE-2026-27797 to make the Homarr server perform arbitrary outbound HTTP requests.

Q: What versions of Homarr are affected by CVE-2026-27797?

Homarr versions prior to 1.54.0 are affected by CVE-2026-27797.

Published Mar 7, 2026

Updated

Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.

Affected Software

2 affected components

Homarr<1.54.0

Homarr Homarr<1.54.0

Remediation

Patch Available

https://github.com/homarr-labs/homarr/commit/fce970c70653f200ff1c73081139a77f0379bd91

Event History

Mar 7, 2026

CVE Published

via MITRE·05:54 AM

Data Sourced

via MITRE·05:54 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-27797?

CVE-2026-27797 has a high severity rating due to the potential for unauthorized external HTTP requests.

How do I fix CVE-2026-27797?

To fix CVE-2026-27797, update Homarr to version 1.54.0 or later.

What type of vulnerability is CVE-2026-27797?