Description
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Published: 2026-09-05
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

MindsDB versions through 26.1.0 expose a server‑side request forgery flaw in the web crawler handler, allowing attackers to supply arbitrary URLs to CrawlerTable.list without authentication. By manipulating the caller‑controlled URLs and exploiting the default empty configuration, an attacker can bypass the allowlist control and retrieve data from any reachable address, including internal services and cloud metadata endpoints. This vulnerability can lead to unintended data disclosure, internal network exploration, or further compromise of connected services. The flaw aligns with CWE‑918, which focuses on SSRF weaknesses.

Affected Systems

Any deployment of MindsDB up to and including version 26.1.0 is affected. The vulnerability is present in all builds that have not applied the configuration changes or upgrade released after 26.1.0.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via unauthenticated HTTP requests to the web crawler endpoint; no special privileges or credentials are required. As a result, the risk remains high until the issue is mitigated through patching or configuration measures.

Generated by OpenCVE AI on September 5, 2026 at 12:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest MindsDB release (26.1.1 or later) that removes the vulnerable web crawler handler.
  • If upgrading is not feasible, modify the MindsDB configuration to enable a restrictive allowlist for the web crawler, specifying only trusted domains that should be reachable.
  • Deploy network controls to block outbound connections from the MindsDB process to internal IP ranges and cloud metadata service URLs, limiting the impact of any remaining SSRF vectors.

Generated by OpenCVE AI on September 5, 2026 at 12:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Title MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
First Time appeared Mindsdb
Mindsdb mindsdb
Weaknesses CWE-918
CPEs cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*
Vendors & Products Mindsdb
Mindsdb mindsdb
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Mindsdb Mindsdb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-05T11:01:25.395Z

Reserved: 2026-09-05T10:40:35.624Z

Link: CVE-2026-86173

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-05T11:16:45.850

Modified: 2026-09-05T11:16:45.850

Link: CVE-2026-86173

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-05T12:30:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)