MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list

Exploitation

poc

Automatable

yes

Technical impact

partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.4%

3. Sep 8, 2026Public exploit observed

   Exploit / PoC code exists

4. Sep 23, 2026Record revised

   Last analysed / modified upstream

5. Sep 25, 2026EPSS peak

   0.4% → 0.6%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026Public exploit / PoC published
• Sep 9, 2026Public exploit flag cleared
• Sep 9, 2026Public exploit / PoC published
• Sep 9, 2026Public exploit flag cleared
• Sep 9, 2026Public exploit / PoC published
• Sep 8, 2026Public exploit flag cleared
• Sep 8, 2026Public exploit / PoC published
• Sep 8, 2026Public exploit flag cleared
• Sep 8, 2026Public exploit / PoC published
• Sep 8, 2026Public exploit flag cleared
• Sep 8, 2026Public exploit / PoC published
• Sep 8, 2026Public exploit flag cleared