HIGHVulnerability

CVE-2026-86259

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

Properties

severity
HIGH
score
7.5
cve_id
CVE-2026-86259
signal_observed_at
2026-09-16T21:37:07+00:00
vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
published_at
2026-09-06T13:17:10.963
last_modified
2026-09-10T19:58:20.507

Related Entities (3)

DESCRIBED_BY (1)

[Source]NVD

HAS_WEAKNESS (2)

[Weakness]Server-Side Request Forgery (SSRF)
[Weakness]Missing Authentication for Critical Function

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-86259 — Ninja Signal Threat Intelligence | Ninja Signal