CVE-2026-86115: Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simto a version that resolves this vulnerability.Fixed in 0.8.14 - Compensating control
Ensure tool URL routing performs strict scheme/host normalization before prefix-based internal classification, so that paths like "/api/" provided in HTTP blocks cannot be treated as internal-only endpoints (e.g., POST "/api/function/execute"); route tool requests only after SSRF/external URL validation based on normalized targets.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated workflow author who can supply URLs or paths in HTTP blocks can exploit it. No user interaction is required.
What access can an attacker gain through exploitation?
The attacker can bypass external URL validation by using a path beginning with /api/, causing the application to treat the request as internal and mint an internal authentication token. This can allow access to internal-only endpoints, including POST /api/function/execute.
How can I assess whether my deployment is exposed?
Treat Sim versions before 0.8.14 as affected. Review HTTP blocks created by workflow authors for user-supplied paths beginning with /api/, especially where those blocks could invoke internal application endpoints.