CVE-2026-10177: Server-Side Request Forgery in Aider-AI Aider
CVE-2026-10177 is a server-side request forgery (SSRF) vulnerability affecting Aider-AI Aider version 0.86.3. The flaw exists in the requests.get function within the api_docs.py file, specifically related to the AWS EC2 Metadata Endpoint component. This vulnerability can be exploited remotely. A patch has been developed and is awaiting acceptance. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
AI Analysis
Technical Summary
CVE-2026-10177 is an SSRF vulnerability in Aider-AI Aider version 0.86.3. It arises from improper handling of requests.get calls in the api_docs.py file, involving the AWS EC2 Metadata Endpoint. This allows an attacker to induce the server to make unauthorized requests, potentially accessing internal resources. The vulnerability is remotely exploitable. Although a patch has been developed, it is not yet officially released. The product is a cloud service, so vendor-side remediation may apply once the patch is accepted.
Potential Impact
The SSRF vulnerability allows remote attackers to make the server perform unauthorized requests, potentially exposing internal AWS EC2 metadata or other internal resources. This can lead to information disclosure or further attacks depending on the internal network configuration. The CVSS score of 5.3 reflects a medium impact with low complexity and no user interaction required.
Mitigation Recommendations
A patch fixing this vulnerability has been developed but is currently awaiting acceptance. Since Aider is a cloud service, the vendor typically manages remediation server-side. Users should monitor the vendor advisory for patch deployment and apply updates once officially released. Until then, no additional vendor-recommended mitigations are specified.
CVE-2026-10177: Server-Side Request Forgery in Aider-AI Aider
Description
CVE-2026-10177 is a server-side request forgery (SSRF) vulnerability affecting Aider-AI Aider version 0.86.3. The flaw exists in the requests.get function within the api_docs.py file, specifically related to the AWS EC2 Metadata Endpoint component. This vulnerability can be exploited remotely. A patch has been developed and is awaiting acceptance. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-10177 is an SSRF vulnerability in Aider-AI Aider version 0.86.3. It arises from improper handling of requests.get calls in the api_docs.py file, involving the AWS EC2 Metadata Endpoint. This allows an attacker to induce the server to make unauthorized requests, potentially accessing internal resources. The vulnerability is remotely exploitable. Although a patch has been developed, it is not yet officially released. The product is a cloud service, so vendor-side remediation may apply once the patch is accepted.
Potential Impact
The SSRF vulnerability allows remote attackers to make the server perform unauthorized requests, potentially exposing internal AWS EC2 metadata or other internal resources. This can lead to information disclosure or further attacks depending on the internal network configuration. The CVSS score of 5.3 reflects a medium impact with low complexity and no user interaction required.
Mitigation Recommendations
A patch fixing this vulnerability has been developed but is currently awaiting acceptance. Since Aider is a cloud service, the vendor typically manages remediation server-side. Users should monitor the vendor advisory for patch deployment and apply updates once officially released. Until then, no additional vendor-recommended mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-30T16:21:45.507Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a1c1203e29bf47b50fe9aa8
Added to database: 05/31/2026, 10:48:35 UTC
Last enriched: 07/08/2026, 13:46:26 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.