CVE-2026-86539CWE-918ssrf

CVE-2026-86539

High · published September 8, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00353 · 27.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-08T03:16Z
References (4)
https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/server/routes/embedding_models.go#L64-L110 · [email protected]https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/server/routes/imports.go#L317-L330 · [email protected]https://github.com/knowns-dev/knowns/security/advisories/GHSA-qx9v-m9gg-p5jg · [email protected]https://www.vulncheck.com/advisories/knowns-through-0.33.0-server-side-request-forgery-via-embedding-models-endpoint · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 0%
    epss
  • 07 SEP 23:03Z
    knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
    cvelistv5