CVE-2026-86539: Server-Side Request Forgery (SSRF) in knowns-dev knowns

The knowns application through version 0.33.0 contains an SSRF vulnerability in the POST /api/embedding-models/test endpoint. This endpoint issues outbound requests to caller-supplied destinations without validating the input, which enables attackers to enumerate internal network hosts and cloud metadata services by observing error messages that reveal network reachability information. This can potentially expose sensitive internal infrastructure details.

Attackers can leverage this SSRF vulnerability to enumerate internal hosts and cloud metadata endpoints, potentially gaining information about internal network topology and cloud environment details. This information disclosure could aid further attacks but does not directly indicate remote code execution or data exfiltration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity targeting the POST /api/embedding-models/test endpoint. Validate and sanitize inputs to this endpoint to prevent SSRF exploitation.