Misskey contains a Server‑Side Request Forgery flaw in its URL preview feature. The flaw allows an attacker to craft a URL preview request that causes the Misskey server to make an outbound HTTP request to any target before performing IP address validation. Because the validation occurs only after the request is sent, the server can reach loopback, private, or link‑local addresses. However, the current implementation rejects the request once the address is identified, and no sensitive internal data is known to be returned by the server to the attacker. The vulnerability therefore primarily permits the server to contact internal services but does not expose any direct data leakage.

All deployments of the Misskey open‑source social platform running a version earlier than 2026.6.0 are affected. The issue was fixed in the 2026.6.0 release, so any instance that has not applied this update remains vulnerable. The affected products are identified by the misskey‑dev:misskey CNA entry, and the vulnerability may impact any server hosting Misskey.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote; an attacker only needs to trigger the SSRF by submitting a malicious URL. Because the server is forced to contact internal addresses, the attacker could probe internal services, execute port scans, or bypass security controls that rely on outbound filtering. However, the lack of data exfiltration limits the immediate impact to reconnaissance or indirect exploitation via other weaknesses.