CVE-2026-86173 in MindsDB
Summary
by MITRE • 09/05/2026
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The identified security flaw resides within the web crawler functionality of MindsDB versions up through 26.1.0, specifically affecting the CrawlerTable.list method which is exposed to unauthenticated users. This vulnerability constitutes a classic Server-Side Request Forgery (SSRF) attack vector where an attacker can manipulate server-side logic to initiate HTTP requests on behalf of the application. By supplying caller-controlled URLs as parameters to this handler, malicious actors are able to direct the internal system to fetch arbitrary resources from any reachable network location. The core technical failure lies in the insufficient validation and sanitization of user-supplied input before it is processed by the underlying request mechanism, allowing external entities to dictate the destination address for server-initiated traffic.
A critical aspect of this vulnerability is the bypassing of existing allowlist controls due to a misconfiguration default state. The system relies on an allowlist to restrict which domains or IP ranges can be accessed via the crawler; however, when no explicit configuration is provided by the administrator, the list defaults to being empty. In many security implementations, an empty allowlist should either deny all requests or require strict whitelisting before any action is taken. Instead, MindsDB interprets this absence of rules as a permission grant, effectively disabling the access control mechanism entirely. This design flaw permits attackers to circumvent intended restrictions and target internal services that are not meant to be exposed to external networks, including cloud metadata endpoints such as those found in AWS EC2 or Azure Instance Metadata Service which often contain sensitive authentication credentials and configuration data.
The operational impact of this SSRF vulnerability is severe, particularly for deployments running on cloud infrastructure or within private network environments where internal services may lack robust perimeter defenses. Successful exploitation allows unauthenticated attackers to perform port scanning, service fingerprinting, and potentially exfiltrate sensitive data from backend systems that are not directly accessible from the public internet. By accessing cloud metadata endpoints, an attacker could retrieve temporary security credentials, IAM roles, or other secrets stored in instance metadata, leading to a complete compromise of the underlying infrastructure's confidentiality and integrity. This capability transforms a simple web application flaw into a potential gateway for lateral movement within a network architecture that assumes internal services are secure from external access.
To mitigate this risk, immediate remediation involves updating MindsDB to a version where the default behavior has been corrected to deny requests when no allowlist is explicitly configured, or implementing strict input validation on all URL parameters passed to the crawler handler. Administrators should also enforce explicit whitelisting of only those domains required for legitimate business operations and ensure that internal services are not accessible via public-facing interfaces unless absolutely necessary with additional authentication layers. From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) as it involves the server making requests to unintended destinations based on user input. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to T1571 Non-Standard Port which may be used for C2 or data exfiltration if internal services are targeted, and potentially T1046 Network Service Discovery if attackers use it to map out the internal network topology.