CVE-2026-86539 knowns-dev CVE debrief

Who should care

Defenders responsible for systems using knowns version 0.33.0 or earlier should assess their exposure to potential enumeration attacks and prioritize verifying the vulnerability's impact on their systems.

Why it matters

CVE-2026-86539 is a server-side request forgery vulnerability in knowns through version 0.33.0 that allows attackers to enumerate internal hosts and cloud metadata endpoints. Defenders should prioritize verifying the vulnerability's impact on their systems and assess exposure to potential enumeration attacks. Remediation priority is high for systems exposed to the internet or untrusted networks.

• Enumeration of internal hosts and cloud metadata endpoints is possible due to the lack of validation in outbound requests.
• Defenders should verify the vulnerability's impact on their systems, especially if using knowns version 0.33.0 or earlier.
• Remediation priority is high for systems exposed to the internet or untrusted networks.

Technical summary

The POST /api/embedding-models/test endpoint in knowns through 0.33.0 is vulnerable to server-side request forgery. This endpoint makes outbound requests to destinations supplied by the caller without proper validation. As a result, attackers can use this vulnerability to enumerate internal hosts and cloud metadata endpoints by analyzing transport error messages that reveal network reachability information.

Defensive priority

Defenders should prioritize verifying the vulnerability's impact on their systems, especially if they use knowns version 0.33.0 or earlier, and assess their exposure to potential enumeration attacks.

Recommended defensive actions

• Verify the vulnerability's impact on your systems, especially if using knowns version 0.33.0 or earlier.
• Assess exposure to potential enumeration attacks.
• Consider updating to a version of knowns that addresses this vulnerability, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in knowns version 0.33.0. The CVE record and NVD entry provide details on the vulnerability, but additional information about affected versions or remediation steps is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.