Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86173MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

High 7.5

In plain English

A high-severity server-side request forgery in mindsdb from mindsdb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

Affected products (as reported)

Vendor	Product	Versions
mindsdb	mindsdb	0 – through 26.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #12480 issue-tracking
CrawlerTable.list allowlist guard technical-description
web_crawling_allowed_sites default technical-description
https://github.com/mindsdb/mindshub product
VulnCheck Advisory: MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler third-party-advisory