CVE-2026-50887: A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5

Synopsis

A Server-Side Request Forgery (SSRF) vulnerability exists in the automatic short URL title resolution component of shlink v5.0.1. The flaw is reachable over the network without any authentication, allowing an attacker to supply a crafted long URL that causes the shlink server to issue HTTP requests to arbitrary internal destinations. Successful exploitation lets the attacker read responses from internal services and modify data accessible through those internal endpoints. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network; an attacker must be able to send HTTP requests to the shlink instance to trigger the SSRF.

• AuthenticationNot required

  No account or credentials are needed; the crafted long URL can be submitted by any unauthenticated caller.

• Victim interactionNot required

  The attacker does not need any user to take an action; submitting the crafted URL directly triggers the server-side request.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• The shlink server issues HTTP requests to attacker-chosen internal addresses, letting the attacker map out services on the internal network that are not publicly reachable.
• Responses from internal services are returned to the attacker, exposing configuration endpoints, internal APIs, metadata services (such as cloud instance metadata), and any credentials or tokens those endpoints serve.
• Because CVSS Integrity is rated High, the attacker can use the SSRF to send state-changing requests to internal services, modifying persisted data or triggering administrative actions on those services.
• Cloud-hosted deployments are at heightened risk of credential harvesting via instance metadata endpoints (for example, AWS IMDSv1), which can lead to lateral movement beyond the container.