Vulnerability Description
Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal network access primitive (e.g., reaching loopback/private ranges) from the Homarr host/container network context. This issue has been patched in version 1.54.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Homarr | Homarr | < 1.54.0 |
Related Weaknesses (CWE)
References
- https://github.com/homarr-labs/homarr/commit/fce970c70653f200ff1c73081139a77f037Patch
- https://github.com/homarr-labs/homarr/releases/tag/v1.54.0Release Notes
- https://github.com/homarr-labs/homarr/security/advisories/GHSA-vwqf-2f4m-2cq2ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-27797?
CVE-2026-27797 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrar...
How severe is CVE-2026-27797?
CVE-2026-27797 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27797?
Check the references section above for vendor advisories and patch information. Affected products include: Homarr Homarr.