Local feeds: "Local server access is not allowed: Host violates local access rules"

[bcutter]

IMPORTANT

Read and tick the following checkbox after you have created the issue or place an x inside the brackets ;)

• I have read the CONTRIBUTING.md and followed the provided tips
• I accept that the issue will be closed without comment if I do not check here
• I accept that the issue will be closed without comment if I do not fill out all items in the issue template.

Explain the Problem

I have a local feed, served by the same webserver which also serves Nextcloud. This local .xml was added to NC News months ago and was working completely fine. For quite a while (days to few weeks roughly, error indicator in NC News shows/counts "371") it does not update. When trying to add this local feed again, the same error message appears as when hovering the already embedded feeds' error counter:

Local server access is not allowed: Host "xxx.xxx.xxx.xxx" (my.public-nextcloud.address:80) violates local access rules

Bitte für weitere Informationen data/nextcloud.log kontrollieren!

The main/ultimate/very first question from my point of view is, if NC News or Nextcloud in general now somehow enforces this SSRF protection. I can not track down when this issue started so I could sort out if it was a NC News app, Nextcloud or even components (PHP-FPM, webserver etc.) update which introduced this.
--> Update:

• last feed element ist from 2026-04-27. I updated NC from 32.0.8.2 to 32.0.9.2 to 33.0.3.2 on 2026-05-01.
• NC News v28.3.0 (https://github.com/nextcloud/news/releases/tag/28.3.0) was released on 2026-05-01 too. I install app updates quite timely.

Please note: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#allow-local-remote-servers is NOT set. Never was and I don't plan to work around this issue using this config setting (because security).
--> Update: For real quick test purposes I can confirm that enabling this config setting makes the error disappear. Strangely after disabling it, everything seems to continue to work without errors in terms of feed updates as the error counter does not increase yet (probably a caching issue, did not restart PHP-FPM after disabling the config setting again), but trying to add the feed again immediately triggers the error again.

Steps to Reproduce

Explain what you did to encounter the issue

1. Create or host a valid RSS feed on the same server that runs Nextcloud.
2. Protect the RSS file using HTTP Basic Authentication.
3. Use a public FQDN (e.g. https://user:password@my.public-nextcloud.address/path/feed.xml) when adding the feed to News.
4. Configure local DNS so that the public FQDN resolves to the server's internal RFC1918 address (split DNS / DNS override).
5. Try to add the feed to NC News.

System Information

• News app version: 28.4.1
• Nextcloud version: 33.0.3.2
• Cron type: (system cron/python updater/...) system cron, for NC News dedicated "nextcloud-news-updater"
• PHP version: 8.4.21
• Database and version: mariadb Ver 15.1 Distrib 10.11.14-MariaDB
• Browser and version: Several, the error is not client but server related
• OS and version: Several, the error is not client but server related

Contents of nextcloud/data/nextcloud.log

[news] Warnung: http://username:password@my.public-nextcloud.address/path/feed.xml read error : Local server access is not allowed: Host "xxx.xxx.xxx.xxx" (my.public-nextcloud.address:80) violates local access rules
	POST /index.php/feeds
	von xxx.xxx.xxx.xxx von User um 02.06.2026, 00:02:36

Contents of Browser Error Console

Read http://ggnome.com/wiki/Using_The_Browser_Error_Console if you are unsure what to put here

Server related

[Grotax]

Hi yes, that news allowed to contact local servers was considered a security risk. You can find a cve for that too.

That is why this is why news now uses the server libraries that filter the requests and deny anything local unless the admin has approved it.

If you, friends and family are the only users on that nextcloud I see no harm in enabling it.

If the instance has potentially untrusted users and the internal network is sensitive I would not recommend that. Then the only way is to host the feeds on a public IP.

That is the security model implemented by nextcloud.

[bcutter]

Thanks for confirming my assumptions. The problem is the mentioned config setting is a system-wide one, valid for core/server and ALL apps. If one single app has a security issue this might be an entry point to local network resources, which is not acceptable. I'd like to at least have the option to limit it to where specifically I need it (the NC News app).

As a self-hosting fan it is kind of strange to "source out" local stuff (like a single XML file for a RSS feed) only to access it again from my own NC instance. The file gets generated locally (script), is served locally (same web server which powers NC, even hosted in the same web root) and accessed locally (by NC News app). I don't see how trying to externalize this makes any overall sense.

Stuck without a proper solution unless I did not miss something...

[Grotax]

Hey, yea that is a downside of this SSRF protrction.

The only option I could find was that news could disable it for its own requests and we could make that an admin setting. But it would still weaken the SSRF protection, the operator that can run occ commands might not be the same that has admin rights for News.

If your nextcloud server is on the internet you could of course consider to also publish your feed via some webeserver on the internet potentially with basic auth. Then your feed would be on the public internet and news would be allowed to fetch it and news supports using basic auth.

[SMillerDev]

We really shouldn't allow overriding the protection for news, then we're just re-introducing the vulnerability.
I see two options to fix this for you:

• Pretend the file is external by adding a DNS entry to the server for something other than these: https://github.com/nextcloud/server/blob/master/lib/private/Net/HostnameClassifier.php#L23
• Allow the server to connect to local domains. It's clearly what you want to happen, and if you're self hosting you might not need the SSRF protection.

[bcutter]

• Option 1 was not a viable solution for my setup.
• Option 2 is also out of scope after a more detailed risk assessment, since I want to avoid disabling SSRF protections globally in a publicly reachable Nextcloud instance.

What I implemented instead (for now) is, in the end, a rather heavy workaround just to access a locally generated RSS feed (XML file):

I extended the existing hostname and TLS setup and introduced a second fully valid public access path to the same Nextcloud instance. The only functional difference is that this second hostname is not overridden by local DNS resolution (which is intentionally used for the primary Nextcloud domain to keep internal traffic local and reduce upstream bandwidth usage). As a result, the second hostname - exclusively used in NC News app for local feeds - always resolves to the public IP address. This prevents Nextcloud’s SSRF protection from classifying the target as a local/internal address, without disabling the protection globally.

I was not comfortable disabling SSRF protection for the entire instance.

What I was actually looking for is a more native solution:

• Allow RSS feeds to be consumed directly from the local filesystem (e.g. via a file-based input instead of requiring an HTTP/HTTPS request).
• In such a model, the feed would be read directly from a local path within the Nextcloud environment instead of being fetched over the network, eliminating the need for DNS workarounds, additional hostnames, or SSRF-related configuration changes.
• This would avoid triggering SSRF protection entirely, since no outbound HTTP request would be made, and would better align with the intended security model while supporting self-hosted setups where feed data is generated locally.

Let me know if you would be open to a feature request for this direction.

[Grotax]

So random file access would be a security risk.

But I could imagine being able to select a file via the files app API so a file the user has access to in nextcloud.

But I have currently no motivation to implement that and no tokens left for it either.
So you can document it as a feature request and detail it also with what happens when the file is deleted or moved but don't expect anyone to pick it up. Feature requests go to the discussions in this repo.

[mcassaniti]

I'm seeing the same error, but I don't think it's the same as the original poster. I'm seeing this for lwn.net which is not local to my machine. I'm seeing it for every external RSS feed (yes all of them). Perhaps I've got something broken.

Running occ background-job:execute --force-execute <JOB_ID> works fine and removes the error, where JOB_ID is the ID from occ background-job:list against OCA\News\Cron\UpdaterJob.

[Grotax]

I guess so, you will need to investigate deeper why Nextcloud might see a local IP. The way it goes is News asks Nextcloud to call the url, it will do a DNS lookup and when that returns one of the forbidden local IPs and the admin has not adjusted the config you get that error.

[mcassaniti]

OK. I'll raise a separate bug later because I have no idea what the issue is.