CVE-2026-86115CWE-441

CVE-2026-86115

Medium · published September 5, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00300 · 22.3th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2026-09-05T14:16Z
References (6)
https://github.com/geo-chen/oss/blob/main/sim.md · [email protected]https://github.com/simstudioai/sim · [email protected]https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/lib/auth/hybrid.ts · [email protected]https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/tools/index.ts · [email protected]https://github.com/simstudioai/sim/pull/7179 · [email protected]https://www.vulncheck.com/advisories/sim-before-0.8.14-confused-deputy-in-tool-url-routing-mints-an-internal-token-for-a-user-supplied-api-path · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
    cvelistv5