A critical server-side request forgery vulnerability in MindsDB allows unauthenticated remote attackers to access internal services and cloud metadata endpoints.

The vulnerability exists within the CrawlerTable.list function of the web crawler handler. By exploiting a default empty configuration for allowed sites, an unauthenticated attacker can bypass allowlist controls to force the application to make arbitrary HTTP requests.

The ability to perform SSRF poses a significant risk to organizational security, as it allows attackers to bypass network perimeters to interact with internal-only services or cloud provider metadata APIs. Successful exploitation could lead to the exposure of sensitive internal data, credential theft from cloud instances, or further lateral movement within the network. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized access to restricted infrastructure.

Immediate Action: Restrict access to the MindsDB web crawler interface via network-level controls or authentication proxies until a vendor-supplied patch is applied.

Proactive Monitoring: Review application and server access logs for anomalous requests to internal IP addresses or cloud metadata service endpoints (e.g., 169.254.169.254) originating from the MindsDB service.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block requests containing suspicious URL parameters directed at internal network segments.

Public Exploit Available: Unknown

Given the potential for unauthorized access to internal resources and cloud environments, this vulnerability should be treated as a priority. Administrators must monitor vendor channels for the release of a security update and apply it immediately upon availability. In the interim, isolating the affected component from external network access is strongly advised to mitigate the risk of exploitation.