VulnSocial

CVE-2026-86259Disclosure

LOWCVSS 9.0 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-06: 2Patch / Workaround · 2026-09-06: 1Technical Details · 2026-09-06: 209-06
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • HOL@HashgraphOnline
    Disclosure

    Anyone who can hit your OpenMAIC can make it fetch cloud credentials. Default install has no access code. Fix is 1.0.1, and you still need ACCESS_CODE set. CVE-2026-86259 https://hol.org/blog/cve-2026-86259-openmaic-ssrf-imds-access-code https://t.co/bvRT2HeaEU

    Post summary

    CVE-2026-86259 is an SSRF in OpenMAIC that could leak cloud credentials; a patch 1.0.1 and ACCESS_CODE requirement are recommended, though no proof‑of‑concept or active exploitation is cited.

    1321301.4K
    19.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-86259 OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata servi… https://www.cve.org/CVERecord?id=CVE-2026-86259

    Post summary

    The CVE describes an SSRF flaw in OpenMAIC versions prior to 1.0.1 that lets unauthenticated attackers access cloud instance metadata via non‑production builds, but no exploit, patch, or active exploitation claims are provided.

    00000747
    58.1K followersView on X

Explore more

Back to dashboard