CVE-2026-86259 Details
Description
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.
A server-side request forgery (SSRF) vulnerability has been identified in OpenMAIC versions prior to 1.0.1. This vulnerability allows unauthenticated attackers to access cloud instance metadata services by exploiting a failure in URL validation that was only applied in production builds. Attackers can manipulate provider URLs through the x-base-url header or baseUrl parameter to retrieve sensitive cloud credentials and metadata.
Users are advised to upgrade to OpenMAIC version 1.0.1 or later, and to set an access code in their .env file before deploying the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 6, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| THU-MAIC OpenMAIC | < 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 6, 2026 | New CVE Received | [email protected] |