| Package | Affected versions | Patched versions |
|---|---|---|
| miniflux.app | ≤ 1.0.46 | |
| miniflux.app/v2 | < 2.0.43 | 2.0.43 |
| miniflux | < 2.0.43 | 2.0.43 |
An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the METRICS_COLLECTOR configuration option is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (the default).
PR #1745 fixes the problem. Available in Miniflux >= 2.0.43.
Set METRICS_COLLECTOR to false (default) or run Miniflux behind a trusted reverse-proxy.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free