CVE-2026-86115 in Sim
Summary
by MITRE • 09/05/2026
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Sim versions prior to 0.8.14 represents a critical server-side request forgery flaw rooted in improper input validation and URL scheme normalization logic. The core technical deficiency lies within the mechanism that distinguishes between internal and external tool requests. Instead of performing robust canonicalization or strict protocol verification, the system relies on simple string prefix matching against URLs to determine their classification. This approach fails to account for variations in how Uniform Resource Locators are parsed by underlying HTTP clients, particularly when scheme information is omitted or ambiguous. Consequently, an attacker can manipulate request parameters to bypass security controls designed to restrict access to internal network resources and services that should not be directly accessible from the application layer.
This architectural oversight allows authenticated workflow authors to execute server-side request forgery attacks against localhost-bound endpoints. By supplying paths that begin with /api/ within HTTP blocks, an attacker can trick the Sim engine into treating these requests as legitimate internal operations rather than external calls requiring validation. The system skips its standard SSRF mitigation checks because it perceives the target URL as belonging to the local environment based on this flawed prefix logic. This bypass is significant because it circumvents the security boundaries intended to isolate the application from sensitive backend infrastructure, effectively granting an authenticated user the ability to interact with internal APIs that are otherwise protected by network-level or authentication-based restrictions.
The operational impact of this vulnerability extends beyond simple data exfiltration or service disruption. Because the forged requests are processed as internal operations, they inherit the privileges and context of the Sim engine itself. This includes the automatic minting of internal authentication tokens for these requests. An attacker can leverage these auto-generated credentials to access sensitive endpoints such as POST /api/function/execute, which may allow for arbitrary code execution or unauthorized manipulation of workflow states within the application. The ability to bypass external URL validation means that even if network firewalls are configured to block outbound connections from the server, an internal SSRF attack remains viable because it targets services running on localhost, effectively rendering perimeter defenses useless against this specific vector.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically highlighting issues related to insufficient validation of user-supplied URLs and lack of scheme normalization. It also relates to CWE-20 Improper Input Validation, as the system fails to correctly interpret or normalize the input data before making security decisions regarding request routing. In terms of offensive cybersecurity frameworks, this technique maps to ATT&CK T1557 Adversary-in-the-Middle, where an attacker positions themselves between two communicating parties to intercept or manipulate communications, and potentially T1046 Network Service Discovery if used to probe internal services for further exploitation.
Mitigation strategies must focus on implementing rigorous URL canonicalization before any security checks are applied. Developers should ensure that all URLs undergo strict parsing using standard libraries that handle scheme normalization correctly, ensuring that relative paths or missing schemes do not default to localhost in a way that bypasses validation logic. Additionally, the application should enforce explicit allow-lists for permitted internal endpoints rather than relying on broad prefix matching. Implementing network-level controls such as egress filtering and restricting local loopback access from untrusted contexts can provide defense-in-depth measures. Upgrading to Sim version 0.8.14 or later is essential, as these versions address the underlying logic flaws that permit this bypass of SSRF protections and unauthorized token minting.