CVE-2026-95656 is a high severity (CVSS 7.3) server-side request forgery in dgtlmoon changedetection.io up to commit 50389b07. The preview endpoint fetches a URL supplied by the caller. The record says upgrading to 0.60.1 resolves it and that an exploit has been published.
What's affected
The record says changedetection.io up to commit 50389b07 is affected, specifically the add_watch_ui_snapshot function in the Preview Endpoint component, where the url argument leads to server-side request forgery. The weakness is CWE-918. The record says the fix is version 0.60.1, and the project has a 0.60.1 tag.
The record also says the exploit has been made public. That comes from the VulDB entry and is not a statement about exploitation in the wild. The CVE is not in CISA's catalog.
The vector is network, low complexity, no privileges required, with low impact on confidentiality, integrity and availability. In practice the risk is what the server can reach: internal services, cloud metadata addresses and anything else on its network.
How to check if you're exposed
Check the installed version.
pip show changedetection.io
For containers, check the image tag and the version in the application's About page. Anything older than 0.60.1 is in scope. Then check exposure. Is the web interface reachable from the internet, or only from a private network? Is a password set? Which internal addresses can the host reach?
What to do now
- Upgrade to changedetection.io 0.60.1 or later.
- Put the interface behind authentication and a VPN or allowlist if it is internet facing.
- Limit outbound network access from the container or host so it cannot reach internal management interfaces or cloud metadata addresses.
- Where your cloud provider supports it, require session based tokens for metadata access.
- Review logs for preview requests to unexpected internal addresses.
- Paste your lockfile or manifest into the free in-browser dependency scan to see whether the affected package is in your tree, then use reachability analysis to separate code paths you call from ones you never touch.
Why it matters
An SSRF bug turns a server into a proxy for the caller. The server can often reach places the caller cannot, such as internal dashboards, databases and metadata services. CWE-918 is a design problem for tools whose job is to fetch arbitrary URLs, since the feature and the risk are the same thing. The fix is to restrict what a fetch can reach.
The score is modest because the direct impact on the tool itself is low. The impact on the network around it can be larger, and that depends on your setup. A public exploit makes quick patching worthwhile.
Quick check
Is this exploited in the wild?
The record says an exploit was made public. It does not say it is exploited in the wild, and the CVE is not in CISA's catalog.
What fixes it?
Version 0.60.1, according to the record and the project's release tag.
Sources
Last reviewed: 18 October 2026.
