CVE-2026-86173CWE-918ssrf

CVE-2026-86173

High · published September 5, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00646 · 50.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-05T15:16Z
References (5)
https://github.com/mindsdb/mindshub · [email protected]https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/integrations/handlers/web_handler/web_handler.py#L50-L65 · [email protected]https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/utilities/config.py#L273 · [email protected]https://github.com/mindsdb/mindshub/issues/12480 · [email protected]https://www.vulncheck.com/advisories/mindsdb-through-26.1.0-unauthenticated-ssrf-via-web-crawler · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 11:01Z
    MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
    cvelistv5