CVE-2026-86173 — MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying…
Published: 2026-09-05 · CVSS: 8.7 · CVSS 4.0
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7