CVE-2026-86173: MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any MindsDB deployment through version 26.1.0 that exposes the web crawler handler to network-reachable, unauthenticated users is exposed. The affected request path does not require authentication.
Does the default configuration prevent exploitation?
No. The allowlist can be bypassed because its default configuration is empty, allowing an attacker to supply arbitrary URLs to CrawlerTable.list.
What can an attacker access?
An attacker can cause the MindsDB server to fetch arbitrary URLs, including internal services and cloud metadata endpoints. The impact is unauthorized access to data reachable from the server's network context.
What can be done if patching is not immediately possible?
Restrict unauthenticated network access to the web crawler handler and prevent the MindsDB server from reaching sensitive internal services and cloud metadata endpoints. These measures reduce the ability to submit attacker-controlled URLs and limit what server-side requests can reach.