CVE-2026-86539 is a server-side request forgery vulnerability affecting knowns through version 0.33.0. The flaw exists in the POST /api/embedding-models/test endpoint, which performs outbound requests to user-supplied destinations without proper validation. This allows an attacker to probe internal network resources and cloud metadata services by leveraging error messages that reveal network reachability information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There is no official remediation level or patch information provided in the available data.

An attacker can exploit this SSRF vulnerability to enumerate internal hosts and cloud metadata endpoints by sending crafted requests to the vulnerable endpoint and analyzing the resulting transport error messages. This can lead to information disclosure about the internal network topology and cloud environment, potentially aiding further attacks. However, no direct code execution or data modification impact is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or implementing network-level controls to limit outbound requests from the application. Monitoring and filtering user input to the POST /api/embedding-models/test endpoint may reduce risk but is not a guaranteed mitigation.