CVE-2026-86539: knowns SSRF Vulnerability

CVE-2026-86539 Overview

CVE-2026-86539 is a server-side request forgery (SSRF) vulnerability affecting the knowns project through version 0.33.0. The flaw resides in the POST /api/embedding-models/test endpoint, which issues outbound HTTP requests to caller-supplied destinations without validation. Unauthenticated attackers can direct the server to contact arbitrary internal hosts and cloud metadata endpoints. Transport-layer error messages returned to the caller reveal whether target hosts are reachable, enabling internal network enumeration. The weakness is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Attackers can enumerate internal services and reach cloud metadata endpoints (for example, AWS IMDS at 169.254.169.254), potentially exposing infrastructure topology and instance credentials.

Affected Products

knowns versions through 0.33.0 (project repository: knowns-dev/knowns)
Deployments exposing the /api/embedding-models/test route to untrusted networks
Cloud-hosted instances where the server has access to instance metadata services

Discovery Timeline

2026-09-07 - CVE-2026-86539 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86539

Vulnerability Analysis

The POST /api/embedding-models/test handler in knowns accepts a destination URL from the request body and uses it to construct an outbound HTTP request. The handler performs no allowlist checks, no destination scheme validation, and no filtering of private, loopback, or link-local address ranges. As a result, an unauthenticated attacker can coerce the server into initiating requests to arbitrary internal or cloud-internal endpoints.

The endpoint compounds the exposure by surfacing transport error text to the caller. Distinct errors returned for connection refused, timeout, TLS handshake failure, or DNS resolution failure allow the attacker to infer host presence, open ports, and service behavior across the server's reachable network. This produces a side-channel oracle suitable for internal reconnaissance.

Root Cause

The root cause is missing validation of user-controlled URL input before it is passed to the HTTP client. The handler treats the destination as trusted configuration data rather than untrusted user input, violating standard SSRF hardening practices described in CWE-918. The relevant handler logic is visible in the upstream source at embedding_models.go L64-L110, with a similar unvalidated request pattern in imports.go L317-L330.

Attack Vector

Exploitation requires network access to the knowns API and no authentication. An attacker submits a crafted JSON body to /api/embedding-models/test specifying an internal target such as http://127.0.0.1:<port>, http://10.0.0.0/8 hosts, or a cloud metadata endpoint. The server executes the outbound request and returns transport-level error content, which the attacker parses to map internal services. Refer to the GitHub Security Advisory GHSA-qx9v-m9gg-p5jg and the VulnCheck advisory for further technical detail.

Detection Methods for CVE-2026-86539

Indicators of Compromise

Unexpected outbound connections from the knowns server process to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
Repeated POST /api/embedding-models/test requests from a single source with varying destination URLs in the body.
Application logs containing transport errors (connection refused, TLS failure, DNS NXDOMAIN) tied to the embedding-models test route.

Detection Strategies

Inspect HTTP access logs for /api/embedding-models/test requests originating from untrusted clients or containing internal IP literals.
Correlate egress firewall logs with knowns process identifiers to spot outbound requests to metadata services or private subnets.
Alert on high-volume, low-latency request bursts to the endpoint that suggest scripted enumeration.

Monitoring Recommendations

Enable structured request logging for all embedding-models and imports routes, capturing full destination URLs.
Forward host and egress telemetry to a centralized analytics platform to detect metadata-endpoint access from application workloads.
Baseline normal embedding-model provider destinations and alert on deviations.

How to Mitigate CVE-2026-86539

Immediate Actions Required

Restrict network access to the knowns API to trusted operators, ideally behind an authenticated reverse proxy or VPN.
Block egress from the knowns host to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges that are not required for operation.
On AWS, enforce IMDSv2 with hop limit 1 to reduce the value of SSRF against instance metadata.

Patch Information

At the time of writing, the NVD entry does not list a fixed version. Monitor the GitHub Security Advisory GHSA-qx9v-m9gg-p5jg for an official patched release, and upgrade to a version later than 0.33.0 once available.

Workarounds

Place the knowns service behind an egress proxy that enforces a destination allowlist for embedding-model providers.
Deploy a network policy (Kubernetes NetworkPolicy, security group, or host firewall) that denies outbound traffic to internal ranges and metadata endpoints.
Disable or remove the /api/embedding-models/test route in reverse-proxy configuration if the feature is not required.

bash

# Example: block metadata and private ranges from the knowns container egress
iptables -A OUTPUT -m owner --uid-owner knowns -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner knowns -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner knowns -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner knowns -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner knowns -d 127.0.0.0/8 -j REJECT