Description

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-07T23:16:53.583Z",
  "pubdate": "2026-09-07T23:16:53.583Z",
  "executiveSummary": "The knowns application, in versions through 0.33.0, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This security flaw exists within the POST /api/embedding-models/test endpoint, which fails to adequately validate or sanitize user-supplied input intended for outbound network requests.\nBy manipulating parameters within the API call, an unauthenticated or authenticated attacker can force the application server to perform arbitrary outbound requests to internal or external destinations. This capability allows an attacker to bypass perimeter security controls and interact with internal network resources, including private services and sensitive cloud metadata endpoints (e.g., 169.254.169.254 in AWS/GCP/Azure environments).\nThe impact is significant, as the vulnerability facilitates internal network reconnaissance, service enumeration, and the potential exfiltration of sensitive configuration data or credentials stored within cloud instance metadata. Successful exploitation relies on the application's ability to reach internal infrastructure, effectively weaponizing the server as a proxy to conduct attacks against the internal network segment. The risk profile is elevated due to the exposure of detailed transport error messages, which provide immediate feedback to the attacker regarding network reachability and service status, simplifying the process of mapping the internal topology.",
  "technicalDetails": "The vulnerability resides in the POST /api/embedding-models/test endpoint, which is designed to validate embedding model configurations. The application improperly handles user-provided destination identifiers during the testing phase, failing to implement an allow-list or perform rigorous input validation against the target URL or hostname.\nThe root cause is a lack of server-side validation for outgoing requests initiated by the application backend. When the /api/embedding-models/test endpoint is triggered, the underlying logic processes the user-supplied destination without verifying whether the target is an external, legitimate resource or a restricted internal address. This architectural oversight allows for the injection of arbitrary hostnames or IP addresses into the outbound request payload.\nThe attack flow proceeds as follows: 1) The attacker crafts a malicious POST request targeting /api/embedding-models/test, substituting the expected embedding model endpoint with an internal target (e.g., internal-service.local or 169.254.169.254). 2) The knowns server interprets this input as a valid target and initiates a connection to the specified resource. 3) The application's network transport layer attempts to establish the connection, and the server returns detailed error messages—such as 'connection refused', 'timeout', or specific protocol errors—to the client. 4) The attacker analyzes these error responses to determine if a host is reachable, open, or closed, thereby performing network port scanning and service discovery from the perspective of the server. 5) By observing these responses, an attacker can pinpoint vulnerable internal services, bypass firewalls, and potentially exfiltrate cloud metadata or internal configuration credentials.\nThe vulnerability affects all versions of knowns up to and including 0.33.0. There are no indications that the endpoint requires specific authorization headers or elevated privileges to execute these requests, rendering it susceptible to unauthorized manipulation. The impact extends beyond simple reconnaissance; it provides a mechanism for further lateral movement within a cloud environment or internal infrastructure, as the server can be induced to interact with services that do not typically require public-facing authentication, assuming they trust traffic originating from the application host."
}