CVE-2026-25123
📋 TL;DR
This vulnerability in Homarr dashboard allows unauthenticated attackers to trigger server-side requests to arbitrary URLs via a public tRPC endpoint. This enables SSRF attacks and port scanning from the Homarr server. All Homarr instances prior to version 1.52.0 are affected.
💻 Affected Systems
- Homarr
📦 What is this software?
Homarr by Homarr
⚠️ Risk & Real-World Impact
Worst Case
Attacker could access internal services, exfiltrate sensitive data, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Internal network reconnaissance, port scanning of internal systems, and potential data exfiltration from internal services.
If Mitigated
Limited to port scanning and basic SSRF if proper network segmentation and egress filtering are in place.
🎯 Exploit Status
Simple HTTP requests to the vulnerable endpoint with crafted URLs can trigger the SSRF.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.52.0
Vendor Advisory: https://github.com/homarr-labs/homarr/security/advisories/GHSA-c6rh-8wj4-gv74
Restart Required: Yes
Instructions:
1. Update Homarr to version 1.52.0 or later. 2. Restart the Homarr service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Network Egress Filtering
allRestrict outbound HTTP/HTTPS traffic from Homarr server to only necessary destinations.
Reverse Proxy Blocking
allConfigure reverse proxy to block requests to the vulnerable endpoint /api/trpc/widget.app.ping
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Homarr from sensitive internal systems.
- Deploy web application firewall rules to block malicious SSRF payloads targeting the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if Homarr version is below 1.52.0. Test by sending a POST request to /api/trpc/widget.app.ping with a URL parameter.Check Version:
Check Homarr dashboard settings or container image tag for version number.Verify Fix Applied:
After updating to 1.52.0+, verify the endpoint no longer accepts arbitrary URLs or returns appropriate error.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Homarr server
- Requests to /api/trpc/widget.app.ping with URL parameters
Network Indicators:
- Unexpected HTTP traffic from Homarr server to internal or external systems
SIEM Query:
source="homarr" AND (uri_path="/api/trpc/widget.app.ping" OR dest_ip IN [internal_ranges])