Description
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mindsdb | mindsdb | ≤ 26.1.0 | — |
References
- GitHub Issue #12480 issue-tracking
- CrawlerTable.list allowlist guard technical-description
- web_crawling_allowed_sites default technical-description
- https://github.com/mindsdb/mindshub product
- VulnCheck Advisory: MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler third-party-advisory