CVE-2026-86539: knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can reach the POST /api/embedding-models/test endpoint can submit caller-controlled destinations. The provided severity vector indicates no privileges or user interaction are required.
What can an attacker learn through exploitation?
They can probe internal hosts and cloud metadata endpoints. Transport error messages reveal network reachability information, enabling internal-network enumeration.
Are deployments through version 0.33.0 affected?
The issue is reported in knowns through version 0.33.0. The provided data does not identify a fixed version or any configuration prerequisite.