CVE-2026-86173

MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

Published Sep 5, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

Analysis

Technical impact

MindsDB versions through 26.1.0 expose a server‑side request forgery flaw in the web crawler handler, allowing attackers to supply arbitrary URLs to CrawlerTable.list without authentication. By manipulating the caller‑controlled URLs and exploiting the default empty configuration, an attacker can bypass the allowlist control and retrieve data from any reachable address, including internal services and cloud metadata endpoints. This vulnerability can lead to unintended data disclosure, internal network exploration, or further compromise of connected services. The flaw aligns with CWE‑918, which focuses on SSRF weaknesses.

Affected Systems

Any deployment of MindsDB up to and including version 26.1.0 is affected. The vulnerability is present in all builds that have not applied the configuration changes or upgrade released after 26.1.0.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via unauthenticated HTTP requests to the web crawler endpoint; no special privileges or credentials are required. As a result, the risk remains high until the issue is mitigated through patching or configuration measures.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mindsdb

unaffected

Version	Status	Constraints
`0`	affected	≤ 26.1.0

No data.

Vendor Product Versions

Mindsdb

Version	Status	Scheme	Platform
`[0,26.1.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest MindsDB release (26.1.1 or later) that removes the vulnerable web crawler handler.
If upgrading is not feasible, modify the MindsDB configuration to enable a restrictive allowlist for the web crawler, specifying only trusted domains that should be reachable.
Deploy network controls to block outbound connections from the MindsDB process to internal IP ranges and cloud metadata service URLs, limiting the impact of any remaining SSRF vectors.

Generated by OpenCVE AI on September 5, 2026 at 12:24 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.646% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/mindsdb/mindshub
https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/integrations/handlers/web_handler/web_handler.py#L50-L65
https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/utilities/config.py#L273
https://github.com/mindsdb/mindshub/issues/12480
https://www.vulncheck.com/advisories/mindsdb-through-26.1.0-unauthenticated-ssrf-via-web-crawler

History

Sep 9, 2026 9:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 5, 2026 11:15 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Title		MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
First Time appeared		Mindsdb Mindsdb mindsdb
Weaknesses		CWE-918
CPEs		cpe:2.3:a:mindsdb:mindsdb::::::::
Vendors & Products		Mindsdb Mindsdb mindsdb
References		https://github.com/mindsdb/mindshub https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/integrations/handlers/web_handler/web_handler.py#L50-L65 https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/utilities/config.py#L273 https://github.com/mindsdb/mindshub/issues/12480 https://www.vulncheck.com/advisories/mindsdb-through-26.1.0-unauthenticated-ssrf-via-web-crawler
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`