Description

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-05T11:16:45.850Z",
  "pubdate": "2026-09-05T11:16:45.850Z",
  "executiveSummary": "MindsDB versions up to and including 26.1.0 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability originating from the web crawler handler.\nThe flaw allows unauthenticated remote attackers to force the MindsDB server to perform arbitrary HTTP requests to internal or external destinations.\nBecause the allowlist mechanism is improperly initialized as an empty configuration by default, attackers can effectively bypass intended security controls.\nThe impact includes unauthorized access to internal services, local network infrastructure, and sensitive cloud metadata endpoints (e.g., IMDS).\nExploitation requires no authentication, allowing malicious actors to perform reconnaissance or interact with services restricted to the server's internal network environment.\nThis vulnerability presents a significant risk, as it provides a vector for lateral movement and potential sensitive data exfiltration from cloud environments or internal APIs.",
  "technicalDetails": "The vulnerability resides within the MindsDB web crawler handler, specifically impacting the CrawlerTable.list function. The root cause is a failure in the input validation and access control logic concerning URL filtering. By design, the crawler handler should utilize an allowlist to restrict outgoing requests to permitted domains or endpoints; however, the application's configuration defaults to an empty set. When the allowlist is not explicitly populated, the verification logic fails to block unauthorized requests, effectively disabling the security boundary.\nThe attack flow begins when an unauthenticated attacker invokes the CrawlerTable.list function by supplying a crafted input string containing the target URL. Because the application processes these requests without performing secondary validation against the intended security policy, the server acts as a proxy for the attacker. The application fetches the requested URL and returns the response or its metadata to the user, confirming successful retrieval.\nThe scope of exploitation extends to internal network resources and cloud-provider metadata services. In cloud-hosted deployments, such as AWS, GCP, or Azure, this SSRF allows an attacker to query the instance metadata service (e.g., 169.254.169.254) to potentially extract sensitive information like IAM roles, security credentials, and instance identities. Furthermore, attackers can perform port scanning of the local interface (127.0.0.1) or identify services within the VPC that are not exposed to the public internet.\nThe vulnerability is persistent across all versions up to 26.1.0. The lack of authentication requirements and the ability to bypass the configuration filter make this a high-severity entry point for attackers to pivot into the underlying server's internal context. No complex payloads are required; a simple URL parameter manipulation is sufficient to trigger the improper request handling. The post-exploitation impact includes unauthorized information disclosure and potential escalation of privileges depending on the services accessible via the server's internal network stack."
}