CVE-2026-86259

    Dashboard / Vulnerabilities / CVE-2026-86259

    CVE-2026-86259

    Published: 6 Sept 2026Last Modified: 25 Sept 2026

    Summary: OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

    Details: OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86259.json, https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-9m7h-vh2h-rc3w, https://nvd.nist.gov/vuln/detail/CVE-2026-86259, https://www.vulncheck.com/advisories/openmaic-before-1.0.1-ssrf-via-environment-gated-url-validation, https://github.com/THU-MAIC/OpenMAIC/releases/tag/v1.0.1, https://github.com/THU-MAIC/OpenMAIC, https://github.com/THU-MAIC/OpenMAIC/blob/v1.0.0/app/api/generate/image/route.ts#L73-L78, https://github.com/THU-MAIC/OpenMAIC/blob/v1.0.0/middleware.ts#L60-L63

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f50a25644c9c3893503cf0727ccf613c0ce1e748

    Affected versions

    @openmaic/[email protected]
    @openmaic/[email protected]
    @openmaic/[email protected]
    @openmaic/[email protected]
    @openmaic/[email protected]
    @openmaic/[email protected]
    @openmaic/[email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86259 | CVE-DB