MindsDB CVE-2026-86173

Exploitation requires network access to a MindsDB instance with the web crawler handler enabled (the default installation includes this handler). The critical enabling condition is the default-empty allowlist in mindsdb/utilities/config.py line 273 - if operators have not explicitly populated this allowlist with permitted domains, no filtering is enforced and all URLs are reachable. No authentication is required (CVSS PR:N confirmed). The MindsDB instance must be reachable from the attacker's network; in typical cloud deployments, the API port may be internet-exposed. Exploitation is further enhanced if the host cloud environment uses IMDSv1 (which requires only a simple GET request to 169.254.169.254). Deployments that have configured a non-empty URL allowlist or have disabled the web_handler integration are not exploitable through this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) and score of 8.7 accurately reflect the threat model: zero-barrier network exploitation with high confidentiality impact. The primary concern is cloud metadata exfiltration - MindsDB is an AI/data platform frequently deployed on cloud infrastructure (AWS, GCP, Azure), making IMDSv1 credential theft a realistic and high-value pivot. EPSS data is not provided; however, the combination of unauthenticated access, trivial exploitation mechanics (a single crafted SQL query or API call), and VulnCheck's detailed code-level advisory substantially raises real-world risk above the average SSRF. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, so this is not yet confirmed actively exploited. The default-empty allowlist means every default MindsDB deployment is affected without any configuration required from the attacker side.

An unauthenticated attacker submits a SQL query or API call to a publicly exposed MindsDB instance targeting the web crawler integration, supplying a URL of http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the fetch target. MindsDB's CrawlerTable.list() performs the outbound HTTP request server-side and returns the AWS IAM role credentials in the response, since the allowlist is empty by default and imposes no restrictions. The attacker uses the retrieved temporary AWS credentials to pivot laterally into the cloud environment.