Is CVE-2026-86115 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86115?

CVE-2026-86115 has a CVSS v3 severity of MEDIUM (5).

Back

CVE-2026-86115

Description

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.