CVE-2026-86115: Sim SSRF Bypass Authentication Vulnerability

CVE-2026-86115 Overview

CVE-2026-86115 is a confused deputy vulnerability in Sim, an open-source AI workflow platform, affecting versions before 0.8.14. The flaw resides in the tool request routing logic, which classifies requests as internal based on URL prefix matching without scheme normalization. This bypass skips Server-Side Request Forgery (SSRF) validation and mints internal authentication tokens for user-supplied paths. Authenticated workflow authors can supply paths beginning with /api/ inside HTTP blocks to reach internal-only endpoints such as POST /api/function/execute. The vulnerability is tracked under CWE-441: Unintended Proxy or Intermediary.

Critical Impact
Authenticated users can bypass external URL validation to invoke internal-only API endpoints with automatically minted internal authentication tokens, enabling unauthorized function execution.

Affected Products

Sim (simstudioai/sim) versions prior to 0.8.14
Sim v0.8.13 hybrid authentication component (apps/sim/lib/auth/hybrid.ts)
Sim v0.8.13 tool index routing (apps/sim/tools/index.ts)

Discovery Timeline

2026-09-05 - CVE-2026-86115 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86115

Vulnerability Analysis

Sim's tool execution layer decides whether an outbound HTTP request targets an internal service by inspecting the URL string with a prefix match. When the classifier sees a path such as /api/function/execute, it treats the request as an internal call, skips SSRF egress checks, and mints an internal authentication token before dispatching the request. The classifier does not normalize the URL scheme or resolve the host component before making this trust decision. An authenticated workflow author can therefore craft an HTTP block whose target begins with /api/ and coerce the platform into invoking privileged internal endpoints on the user's behalf.

Root Cause

The root cause is a classic confused deputy pattern combined with unsafe input parsing. The routing code in apps/sim/tools/index.ts uses URL prefix matching to distinguish internal from external destinations. Because the check runs on the raw user-supplied string without scheme normalization, an attacker-controlled path is indistinguishable from a legitimate internal call. The hybrid authentication logic in apps/sim/lib/auth/hybrid.ts then attaches an internal token to the request, granting the caller the platform's own trust level.

Attack Vector

Exploitation requires an authenticated account with permission to author workflows. The attacker creates or edits an HTTP block and sets the target URL to a path starting with /api/, for example /api/function/execute. Sim's routing layer classifies the request as internal, skips SSRF validation, mints an internal token, and forwards the request to the internal endpoint. This gives the attacker the ability to invoke internal-only functionality that the workflow user should not be able to reach directly. See the VulnCheck Security Advisory for the full technical breakdown.

No verified proof-of-concept code is published. Refer to GitHub Pull Request #7179 for the upstream fix.

Detection Methods for CVE-2026-86115

Indicators of Compromise

HTTP block configurations in workflows containing target URLs that begin with /api/ rather than a fully qualified https:// scheme.
Application logs showing invocations of internal endpoints such as POST /api/function/execute originating from user-authored workflow tool calls.
Internal authentication tokens minted for requests whose original source is a user-supplied HTTP block URL.

Detection Strategies

Audit Sim workflow definitions for HTTP blocks whose URL field lacks a scheme (http:// or https://) or resolves to a relative /api/ path.
Correlate outbound tool invocations with the responsible workflow author and flag any that reach /api/function/execute or other internal-only routes.
Compare running Sim deployments against the patched release 0.8.14 and alert on any instance still serving v0.8.13 or earlier.

Monitoring Recommendations

Enable verbose logging on the Sim tool router and hybrid authentication layer to record the pre-normalization URL, the classification decision, and the token type issued.
Forward Sim application and web-server logs to a centralized analytics platform to baseline normal tool invocations and surface anomalous internal calls.
Monitor for workflow-edit events immediately followed by tool executions that hit internal API paths.

How to Mitigate CVE-2026-86115

Immediate Actions Required

Upgrade all Sim deployments to version 0.8.14 or later, which contains the fix delivered in Pull Request #7179.
Review existing workflows for HTTP blocks pointing at /api/ paths and remove or rewrite any that target internal endpoints.
Restrict workflow authoring permissions to trusted users while patching is in progress.

Patch Information

The maintainers of Sim resolved CVE-2026-86115 in release 0.8.14. The fix normalizes URL parsing before classification and prevents user-supplied relative paths from being treated as internal requests. Source code for the patched components is available in the Sim project repository. Administrators should redeploy from the tagged 0.8.14 release or later.

Workarounds

Enforce an egress allowlist at the network layer so that Sim can only reach approved external hosts and cannot loop back to its own internal API surface from tool blocks.
Disable or gate the HTTP block tool for non-administrative workflow authors until the upgrade is complete.
Add a reverse-proxy rule that rejects tool-originated requests whose target path begins with /api/ and lacks an explicit external host.

bash

# Example nginx rule to block relative /api/ paths originating from Sim tool egress
location /api/ {
    if ($http_x_sim_tool_origin = "1") {
        return 403;
    }
}