CVE-2026-86539 in Knowns
Summary
by MITRE • 09/08/2026
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The identified security flaw resides within version 0.33.0 of the software, specifically affecting the POST /api/embedding-models/test endpoint which is designed to validate connectivity or configuration for embedding models. This component exhibits a classic server-side request forgery vulnerability by accepting user-supplied input and utilizing it as the destination for outbound network requests without implementing adequate validation mechanisms. The core technical deficiency lies in the failure to restrict the scope of allowed destinations, allowing an attacker to dictate arbitrary URLs including internal private IP addresses or cloud provider metadata endpoints such as those found on AWS EC2 instances or Azure managed identities. This lack of input sanitization and URL scheme restriction enables a remote unauthenticated actor to manipulate the server into acting as a proxy for network reconnaissance activities.
The operational impact of this vulnerability is significant, primarily facilitating internal network enumeration and potential credential theft through cloud metadata service exploitation. By observing specific transport error messages returned by the API response, an attacker can determine whether a target host or port is reachable based on differences in latency, connection refused errors, or timeout indicators. This side-channel information allows for precise mapping of the internal network topology, identifying live hosts and open services that are not directly exposed to the public internet. Furthermore, if cloud metadata endpoints are accessible from the server environment where this software runs, attackers can retrieve sensitive authentication tokens, temporary security credentials, and instance configuration data without needing direct access to those resources, effectively bypassing perimeter defenses through SSRF-induced lateral movement or privilege escalation within the cloud infrastructure.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which covers flaws where a web application fetches a remote resource without validating the user-supplied URL. Additionally, the technique of using error messages to infer network reachability corresponds to ATT&CK T1046 Network Service Discovery, specifically within cloud environments where metadata services are often targeted for credential harvesting as described in techniques like T1528 Steal Application Access Credentials or T1098 Account Manipulation if persistent access is established. The exploitation relies on the server's ability to make outbound connections and its tendency to leak internal network state through error handling logic, which should be strictly controlled to prevent information disclosure during request processing failures.
To mitigate this vulnerability, immediate remediation involves implementing strict allow-listing for outbound requests initiated by the embedding model test endpoint. The application must validate that any provided URL points only to explicitly trusted domains or IP ranges required for legitimate functionality, rejecting all other inputs with a generic error message that does not reveal network status details such as timeouts versus connection refused errors. It is also critical to disable HTTP redirects if they are not strictly necessary, as attackers often use redirect chains to bypass simple domain-based filters and reach internal targets via external domains. Network-level controls should be employed in conjunction with application fixes, including configuring firewalls or security groups to block outbound traffic from the server to private IP ranges and cloud metadata endpoints like 169.254.169.254 for AWS or similar addresses for other providers. Regular auditing of API endpoints for SSRF risks and ensuring that error responses are sanitized to remove internal network information will further reduce the attack surface and prevent exploitation by malicious actors seeking to enumerate internal infrastructure.