Stoat CVE-2026-73057–73059: image proxy SSRF and DoS meet a history-permission bypass

CVE-2026-73057, CVE-2026-73058 and CVE-2026-73059 for the open-source Stoat messaging platform, formerly Revolt, were published on 16 August 2026. The first two issues affect the January media-proxy service: a remote SVG can drive a huge memory allocation, while an omitted IPv6 :: address bypasses SSRF filtering and reaches a loopback service. The third sits in the Delta API and lets a channel member fetch one message despite lacking permission to read message history.

Upstream advisories appeared earlier, on 2 August; publication of the CVE records was the event on 16 August. All three issues are corrected in Stoat 0.15.0. Self-hosted administrators need to inspect every service version because updating a front end or one container does not automatically replace January and Delta images.

The set is a compact study of three boundaries. A URL proxy separates the Internet from an internal network. An image decoder separates a small input file from its in-memory cost. A permission model separates seeing a channel from reading its older content. Each weakness arose where one path missed a rule applied to its sibling path.

CVE-2026-73058: one missing SSRF address

A media proxy retrieves an external URL so users do not contact an untrusted content server directly and the platform can create controlled previews. The proxy also becomes an HTTP client from the perspective of Stoat’s infrastructure. If it accepts an internal address, an attacker may use it to read a service that is not exposed to the Internet.

The SSRF advisory identifies a precise asymmetry. The blocklist covered IPv4 0.0.0.0/8, private ranges, 127.0.0.0/8, link-local addresses and some IPv6, including ::1 and ULA. It omitted the IPv6 unspecified address ::. On Linux, a TCP connection to that address can route to loopback, so an IPv6-literal URL passed validation and reached a local service.

The /proxy and /embed endpoints were unauthenticated, so the request required no account. The CVE describes access to content reachable from January’s loopback. Actual impact depends on what listens locally, whether it requires authentication and whether the proxy returns its response to the caller.

This was an incomplete-fix pattern. Earlier protections addressed DNS rebinding and validation of resolved addresses but missed one semantically equivalent representation. Effective SSRF controls must normalise IPv4, IPv6, mapped addresses, DNS and redirects. Where the product permits it, an allowlist of destinations is stronger than an ever-growing denylist.

CVE-2026-73057: a small SVG, a huge buffer

SVG is a text document describing an image rather than a ready pixel array. Its viewBox can declare dimensions far larger than the downloaded file. The affected January path passed those dimensions into pixmap construction without a suitable upper bound.

The CVE-2026-73057 advisory notes that a 20,000 by 20,000 image can require roughly 1.4 GB for one request. Concurrent proxy calls can therefore exhaust replicas, cause severe swapping or make the platform’s OOM policy terminate them.

Limiting downloaded bytes does not solve this class. A few hundred XML bytes can describe an enormous canvas. Controls need to validate width, height, total pixels, channel format, predicted decoding cost and processing time. Rejection should happen before buffer allocation, and decoding should run in a process with a hard memory limit.

High availability does not neutralise the weakness. A load balancer sending subsequent requests to healthy replicas may help spread the attack across the cluster. Per-source rate limits, a global cap on concurrent decoding and a backpressure-aware queue matter as much as replica count.

CVE-2026-73059: visible channel, hidden history

Stoat separates ViewChannel from ReadMessageHistory. An administrator may let a user see a channel and new events while withholding access to older messages. Bulk search and history-list endpoints enforced that distinction.

The permission advisory explains that the endpoint fetching one message by identifier checked only ViewChannel. A member denied ReadMessageHistory could not list or search history, but could retrieve full content when they knew a message ID.

This is a horizontal authorisation failure, not public access to every message. The attacker must be a member able to view the channel, and the default role normally grants both permission bits together. Exposure appears in intentionally split policies, such as those for new members, temporary channels or archive-restricted roles.

The issue resembles classic BOLA/IDOR, but predictability of an identifier is not its core. Even a fully random ID cannot replace object-level access control. Every path returning a message — listing, search, direct link, quoting, export and notification — must invoke the same central authorisation decision.

Who is exposed

The CVE records identify Stoat releases before 0.15.0 as affected. Priority goes to self-hosted deployments exposing January to the Internet and organisations using custom roles that split ViewChannel from ReadMessageHistory. For a managed service, the operator performs the update, but customers should still confirm status and inspect their own telemetry.

Inventory must cover immutable container digests, not only a release label in the user interface. A cluster can retain some old replicas after an incomplete rollout. Inspect deployments, scheduled jobs, node-cached images and the policy enforcing immutable digests.

The sources do not show widespread active exploitation. Absence of a public incident is not a reason to delay, because proxy endpoints are unauthenticated and scanners can test the technical conditions easily.

What defenders should do now

Upgrade every Stoat component to 0.15.0 or a later supported release. Perform a digest-controlled rollout, wait until all replicas are replaced and remove affected images from private registries and node caches where organisational procedure calls for it.

Restrict media-proxy egress. January generally needs Internet access but should not reach management networks, cloud metadata, cluster control planes, databases or administrative loopback ports. A network policy remains a second barrier when URL validation misses another address representation.

Set time, response-size and concurrency limits at the reverse proxy. Enforce maximum width, height and pixel count inside the decoder before allocation. A separate worker pool for media processing keeps decoder memory pressure away from the messaging API.

Review roles. For every ViewChannel=yes and ReadMessageHistory=no variant, exercise all message retrieval paths. Tests should prove denial for a single ID, quote, search, export and message-related attachment.

Detection and historical review

For SSRF, look for proxy requests to IPv6 literals, destinations not classified as public, unusual ports and responses resembling local administration services. Log the normalised destination after DNS and redirects while avoiding credentials embedded in URLs.

For SVG processing, monitor the ratio between file size and declared dimensions, RSS spikes, OOMKills and January restarts. Bursts of the same external URL across replicas may indicate automated resource exhaustion.

For authorisation, correlate history-endpoint denials with a later successful single-message fetch by the same account. That sequence is a stronger signal than an ID-based read alone, which is normal messaging functionality.

Lessons for service designers

An SSRF policy must evaluate a canonical address after every redirect. It needs full IPv4 and IPv6 equivalents, but where business requirements allow, an allowlist of protocols, ports and public destinations is stronger. Network protection should not depend on one application parser.

Decoding cost must be predicted from metadata before allocation. An input-byte limit does not control logical bombs in SVG, PDF, archives or model files. The same pattern applies to AI pipelines creating previews of untrusted documents.

Authorisation should be a domain function called by every representation of an object. Copying different sets of conditionals into endpoints almost guarantees drift. A role test matrix documents the contract and belongs in CI.

Facts and Breachroad conclusions

It is a fact that the three CVE records published on 16 August describe unbounded SVG rendering, SSRF through IPv6 :: and a missing ReadMessageHistory check on the single-message path. All identify 0.15.0 as the fixed release. Upstream advisories existed earlier, and the sources do not establish widespread exploitation.

Breachroad’s conclusion is to test equivalent paths, not only a single correction: IPv4 and IPv6, small input and expensive output, message listing and single-message retrieval. The next vulnerability often sits in the overlooked sibling of a protected function.

Teams building messaging products, media proxies and APIs can explore these patterns through our cybersecurity training for organisations. Independent SSRF and authorisation validation is available through web application and API penetration testing.