Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86539

knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86539

Published

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86539

Published

knowns

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "knowns-dev",
                    "product": "knowns",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:npm/knowns",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "0.33.0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON