CVE-2026-86539 — knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied desti…
Published: 2026-09-07 · CVSS: 6.9 · CVSS 4.0
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7