CVE-2026-25123
Medium
Description
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.
SeverityMedium
CVSS5.3
Exploit probability—
ProductHomarr
PublishedFeb 6, 2026
First seenFeb 6, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- homarr homarr1.52.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| homarr homarr | v < 1.52.0 | 1.52.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.