TI-2026-59045 Aliases CVE-2026-86259 GHSA-6j8v-fv4p-986p

OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

HIGH 72CWE-306Published 2026-09-06 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00416 36th percentileScored 2026-11-07

Fix Fixed OpenMAIC (THU-MAIC): 1.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
THU-MAIC	OpenMAIC	before 1.0.1	1.0.1	Patch available	CNA

OpenMAIC VendorTHU-MAIC Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA

Remediation

Fix · CNA OpenMAIC (THU-MAIC) Fixed in 1.0.1

Timeline

2026-10-02 Threatist record created from CVE-2026-86259
2026-10-03 Alias added: GHSA-6j8v-fv4p-986p

References

Patch 1

OpenMAIC v1.0.1 Release Notes

Advisory 1

GitHub Security Advisory (GHSA-9m7h-vh2h-rc3w)

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences