VulnerabilityAnalyzed

CVE-2026-27797

Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests.

MEDIUM 5.3EPSS 0.43%

Does this matter?

Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.

Description

Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.43% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: homarr/homarr
Source: security-advisories@github.com

References

https://github.com/homarr-labs/homarr/commit/fce970c70653f200ff1c73081139a77f0379bd91Patch
https://github.com/homarr-labs/homarr/releases/tag/v1.54.0Release Notes
https://github.com/homarr-labs/homarr/security/advisories/GHSA-vwqf-2f4m-2cq2Exploit, Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.