---
id: CVE-2026-54339
title: Glean is a self-hosted RSS reader and personal knowledge management tool
summary: >-
  Glean is a self-hosted RSS reader and personal knowledge management tool.
  Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url
  to discover_feed(feed_url), creates a subscription through
  FeedService.create_subscri…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: LeslieLeung
product: glean
affected:
  - glean < 0.2.6
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54339'
references:
  - url: >-
      https://github.com/LeslieLeung/glean/commit/cdc05dd34df58d8d210e0cbed0ccc60108e4eeed
    label: security-advisories@github.com
  - url: 'https://github.com/LeslieLeung/glean/releases/tag/v0.2.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/LeslieLeung/glean/security/advisories/GHSA-78qf-q8fg-jcpg
    label: security-advisories@github.com
  - url: >-
      https://github.com/LeslieLeung/glean/security/advisories/GHSA-78qf-q8fg-jcpg
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00472
epssPercentile: 0.38099
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T21:14:19.278705Z'
ingestedAt: '2026-09-17T21:29:16.981Z'
---

## Overview

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url), creates a subscription through FeedService.create_subscription(), and enqueues fetch_feed_task. The background path calls fetch_feed(feed.url) and parse_feed(), which assigns each RSS item link to ParsedEntry.url. The task then passes ParsedEntry.url to fetch_and_extract_fulltext(parsed_entry.url) without network-level validation in backend/packages/rss/glean_rss/extractor.py and backend/apps/worker/glean_worker/tasks/feed_fetcher.py. A malicious feed can therefore make the server request private, loopback, link-local, or cloud-metadata resources. The fetched response is stored in Entry.content and can be retrieved through GET /api/entries/{id}, producing non-blind server-side request forgery with full response disclosure. This can bypass network perimeters, probe internal services and ports, expose internal configuration or web content, and potentially disclose cloud metadata access tokens. This issue is fixed in version 0.2.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.