An unauthenticated Server‑Side Request Forgery (SSRF) flaw was discovered in Homarr’s rssFeed.ts module. The vulnerability allows an attacker to supply arbitrary URLs to the Homarr server, which then performs outbound HTTP or HTTPS requests from the host or container. This can serve as a gateway to internal network resources such as loopback or private IP ranges, potentially exposing sensitive services. The weakness is classified as CWE‑918, indicating improper validation of user‑supplied URLs.

The flaw affects the open‑source Homarr dashboard from homarr‑labs, with all releases prior to version 1.54.0 vulnerable. Users running any earlier version of Homarr on a publicly reachable host or container are at risk.

The CVSS score of 5.3 reflects a moderate impact with an unauthenticated attack vector and network access. The EPSS score of less than 1 % indicates a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted request to the rssFeed endpoint, which requires no authentication, and therefore can be performed from any external network that can reach the Homarr instance. If successful, the extent of damage is limited to the reachability of outbound network resources from the Homarr host.