Misskey: Missing rate limiting and size limits in unauthenticated fetch-rss API
Summary
Misskey, an open source federated social media platform, has an unauthenticated fetch-rss API that lacks rate limiting and response size limits and parses XML synchronously. An attacker without an account can make the server send unbounded outbound HTTP requests, which can exhaust instance resources, amplify traffic toward third-party servers, or probe reachable network services, even when federation is disabled. The CVSS 4.0 base score of 8.7 comes from the CVE record; NVD analysis is still pending.
Affected
- Misskey versions before 2026.7.0 (the CVE record lists affected ranges from 12.0.0 to 13.14.2 and from 2023.9.0-beta.1 to before 2026.7.0; the exact boundaries are not yet confirmed by the vendor advisory)
Fixed in
- Misskey 2026.7.0 or later (current release recommended)
Workaround
- No vendor workaround is documented.
- Interim measures (not vendor guidance): restrict or block public access to the fetch-rss endpoint at the reverse proxy, apply rate limits in front of the API, and restrict outbound traffic from the server to internal networks and cloud metadata services.
Exploitation
- No evidence of in-the-wild exploitation or public proof of concept was found at the time of research.
- CISA SSVC (per CVE record): exploitation none, automatable yes, technical impact partial.
- Not listed in CISA KEV at the time of research.
Our recommendation
- Identify any Misskey instances in your organisation, including community or marketing projects.
- Confirm the affected version range in the GitHub security advisory.
- Upgrade to Misskey 2026.7.0 or later after reviewing the pre-upgrade notes.
- Until patched, restrict access to the fetch-rss endpoint and monitor CPU, memory and outbound request volume.
- Internet-facing instances have the highest priority; internal-only instances are lower risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4x7v-qx8f-g3p8 github.com
- Misskey fix commit a12ee2e github.com
- Misskey release 2026.7.0 github.com
- OSV entry CVE-2026-104817 osv.dev
- VulDB entry 417915 vuldb.com
- Strix CVE-2026-104817 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:22.
Original description (NVD)
Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.