CVE-2026-86173

    Dashboard / Vulnerabilities / CVE-2026-86173

    CVE-2026-86173

    Published: 5 Sept 2026Last Modified: 25 Sept 2026

    Summary: MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

    Details: MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86173.json, https://nvd.nist.gov/vuln/detail/CVE-2026-86173, https://www.vulncheck.com/advisories/mindsdb-through-26.1.0-unauthenticated-ssrf-via-web-crawler, https://github.com/mindsdb/mindshub/issues/12480, https://github.com/mindsdb/mindshub, https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/integrations/handlers/web_handler/web_handler.py#L50-L65, https://github.com/mindsdb/mindshub/blob/v26.1.0/mindsdb/utilities/config.py#L273

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -86be14b66b169e040abe5bf5829b6a15d0644d6b

    Affected versions

    v26.0.1
    v26.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86173 | CVE-DB