Is CVE-2026-86539 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86539?

CVE-2026-86539 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-86539

Description

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.