CVE-2026-86173

HighCVSS 7.5

Published: 05/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

31th percentile - higher than 31% of all known CVEs

Summary

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

Risk Assessment

The risk includes access to internal network resources and cloud metadata, potentially leading to sensitive information disclosure and further attacks.

Recommendation

Update MindsDB to a patched version and configure an allowlist for URLs.

Other vulnerabilities in MindsDB

CVE-2026-92207High
MindsDB contains a code injection remote code execution vulnerability in the OpenBBtable class. Authentication is required; the flaw is due to lack of validation of a user-supplied string before using it to execute Python code, allowing an attacker to execute code in the context of the service account.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS