Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-08 | 1 | Disclosure1 |
| 2026-09-11 | 1 | Patch1 |
CVE-2026-86539 knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-sup… https://www.cve.org/CVERecord?id=CVE-2026-86539
Post summary
The statement discloses a server‑side request forgery vulnerability in the /api/embedding‑models/test endpoint of version 0.33.0, without providing PoC, exploit, or patch details.
🚨 HIGH: CVE-2026-86539 (CVSS 7.2) - SSRF vulnerability in knowns ≤0.33.0 at POST /api/embedding-models/test. Attackers can enumerate internal hosts & cloud metadata endpoints via error messages. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/xscVc6KZ3m
Post summary
The tweet discloses a high‑severity SSRF vulnerability (CVE‑2026‑86539) and urges users to apply the patch immediately to prevent internal host enumeration.