Server-Side Request Forgery Issue in MindsDB Product by MindsDB

CVE-2026-86173

What is CVE-2026-86173?

MindsDB version 26.1.0 is affected by a server-side request forgery vulnerability within its web crawler handler. This flaw enables unauthenticated attackers to manipulate caller-controlled URLs within the CrawlerTable.list function, allowing unauthorized access to arbitrary URLs. Attackers can exploit this vulnerability to bypass the allowlist control, which is ineffective due to the default empty configuration. Consequently, this opens doors for potential access to sensitive internal services and cloud metadata endpoints without any authentication, raising significant security concerns for users.

References