CVE Feed

    Dashboard / CVE / CVE-2026-27797

    CVE-2026-27797

    Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.

    Published:Mar 7, 2026
    Last Modified:Apr 16, 2026
    EPS:Mar 7, 2026
    EPSS Score:0.0005
    CVSS Score:5.3

    Affected Products

    Vendor
    Homarr
    Product
    Homarr
    Vendor
    Homarr-labs
    Product
    Homarr

    Exploits

    https://github.com/homarr-labs/homarr/security/advisories/GHSA-vwqf-2f4m-2cq2

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-33510 (CVSS 8.8) — Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has …
    CVE-2026-32602 (CVSS 4.2) — Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) …
    CVE-2026-27796 (CVSS 5.3) — Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is ex…
    CVE-2026-25123 (CVSS 5.3) — Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping …
    CVE-2025-67493 (CVSS 7.5) — Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed p…
    CVE-2025-64759 (CVSS 8.1) — Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the exe…
    CVE-2025-54313 (CVSS 7.5) — eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compro…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High