CVE-2026-33407 is a server side request forgery in Wallos, a self-hosted subscription tracker. NVD scores it 9.1 critical. The logo search endpoint trusts proxy settings from the environment and resolves user supplied search terms. The record says version 4.7.0 fixes it.
What's affected
Wallos before 4.7.0 per the NVD record. The GitHub advisory describes version 4.6.2 as affected and lists 4.6.2 and below, but its patched versions field says none. Check the 4.7.0 release and the linked commit to confirm the fix before you rely on it.
How to check if you're exposed
Find your Wallos version in the app or in your container image tag, and compare it with 4.7.0. Then see who can reach the instance. The advisory describes the endpoint as reachable by any user who can send requests to it, so an instance exposed to the internet carries more risk than one on a private network.
What to do now
- Upgrade to Wallos 4.7.0 or later and confirm the release contains the fix.
- Keep Wallos off the public internet if you can. Put it behind a VPN or an authenticating reverse proxy.
- Make sure the host has no unexpected HTTP_PROXY or HTTPS_PROXY variables set.
- Restrict outbound traffic from the server so it cannot reach internal services or cloud metadata addresses.
Why it matters
The record lists CWE-918, server side request forgery, and CWE-922, insecure storage of sensitive information. SSRF turns your server into a client that an outsider steers. It can be used to probe internal networks or cloud services the attacker cannot reach directly.
The advisory notes the flaw is separate from an earlier webhook SSRF in the same project. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is a self-hosted app on my home network at risk?
Less so than a public one, but anything on your network that can reach the instance can reach the endpoint. Upgrade anyway.
Sources
Last reviewed: 19 October 2026.
