Description
A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.
Published: 2026-10-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server-side request forgery
Action: Immediate Patch
AI Analysis

Impact

A server‑side request forgery flaw exists in the is_global_ip function of mistral.rs. An attacker can supply arbitrary IP values, causing the server to perform HTTP requests to those addresses. This can expose internal services or retrieve sensitive data from outbound destinations. The vulnerability can be triggered remotely without authentication, and the exploit has been publicly disclosed.

Affected Systems

The flaw affects EricLBuehler’s mistral.rs library version 0.9.3 and earlier. The security patch is included in release 0.9.4. Users running the affected code base are at risk.

Risk and Exploitability

The CVSS v3 score is 6.9, indicating a medium severity impact. No EPSS score is available. The vulnerability is not currently listed in the CISA KEV catalog, but it is an exploited, publicly documented issue. Because it is reachable over the network, attackers can launch requests from remote hosts, potentially circumventing internal network defenses.

Generated by OpenCVE AI on October 13, 2026 at 00:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to mistral.rs 0.9.4 or later to apply the CVE fix.
  • If upgrading immediately is not possible, restrict outbound traffic from the mistral.rs process to known and trusted destinations using firewall or network segmentation.
  • Sanitize input to the is_global_ip function or enforce an allow‑list of IP ranges to prevent arbitrary requests.

Generated by OpenCVE AI on October 13, 2026 at 00:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.
Title EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery
First Time appeared Ericlbuehler
Ericlbuehler mistral.rs
Weaknesses CWE-918
CPEs cpe:2.3:a:ericlbuehler:mistral.rs:*:*:*:*:*:*:*:*
Vendors & Products Ericlbuehler
Ericlbuehler mistral.rs
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ericlbuehler Mistral.rs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T14:37:07.344Z

Reserved: 2026-10-11T18:30:55.826Z

Link: CVE-2026-108939

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T00:17:00.343

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-108939

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:30:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)