Knowns CVE-2026-86539

The vulnerable endpoint POST /api/embedding-models/test must be reachable by the attacker - no authentication is required per the CVSS 4.0 PR:N metric. The feature does not need to be explicitly enabled beyond default deployment; it is part of the standard embedding-model workflow. Exploitation severity is amplified when the host runs in a cloud environment with IMDSv1 accessible (default on older AWS configurations) or when no egress filtering blocks access to private IP ranges. The only limiting factor is network reachability to the Knowns API port; if deployed behind a VPN or internal-only network, exposure is limited to insider threats or attackers who have already achieved perimeter access.

The CVSS 4.0 score of 6.9 (Medium) reflects that exploitation is trivial in terms of access (AV:N, AC:L, PR:N, UI:N) but impact is bounded (VC:L, VI:L). The primary real-world risk is cloud credential theft: if deployed on AWS, GCP, or Azure without IMDSv2 enforcement or metadata service firewall controls, an attacker can retrieve instance identity tokens via the SSRF. Secondary risk is internal-network reconnaissance, enabling further lateral movement. No EPSS score is provided in the input data; without it, exploitation probability cannot be quantified precisely. No KEV listing and no public POC exist at time of analysis, limiting the urgency for most environments. The risk is highest for cloud-hosted deployments without metadata endpoint egress restrictions and for instances where the API is internet-exposed without authentication.

An unauthenticated external attacker sends a POST request to /api/embedding-models/test with a payload specifying a destination of http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted Knowns instance. The server issues the outbound request and returns differing error messages depending on whether the target responded, allowing the attacker to confirm IMDS reachability and potentially retrieve temporary IAM credentials. The attacker then repeats the process across RFC-1918 subnets to map internal services. No POC code is publicly available, but the attack requires only standard HTTP tooling.