CVE-2023-27591High· 7.5▾ TwilightUnauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICS_COLLECTOR configuration option is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (the default).
PR #1745 fixes the problem. Available in Miniflux >= 2.0.43.
Set METRICS_COLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
miniflux.app/v2 < 2.0.43miniflux.app <= 1.0.46Upgrade to a patched release:
miniflux.app/v2 2.0.43Connected by shared product, vendor, weakness, or advisory.