SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-86173

HIGH · CVSS 7.5 EPSS 0.37% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-05 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

MindsDB versions up to 26.1.0 are vulnerable to a server-side request forgery (SSRF) flaw in the web crawler handler, enabling unauthenticated attackers to retrieve arbitrary URLs by manipulating input to CrawlerTable.list. This vulnerability allows attackers to bypass allowlist restrictions, potentially exposing internal services and cloud metadata endpoints. Organizations using MindsDB should prioritize addressing this issue to mitigate the risk of unauthorized access to sensitive internal resources.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86173
Severity
HIGH
CVSS
7.5
EPSS
0.37%

Original NVD Description

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.