Security Advisory
CVE-2026-86539
CVSS 7.2
HIGH
Vulnerability Description
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Published Date
2026-09-07T23:16:53.583
Data Feed
NIST National Vulnerability Database