CVE-2026-108939

Deferred Deferred - Pending Action

Server-Side Request Forgery in mistral.rs

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: VulDB

Description

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108939

EUVD

EUVD-2026-98092

Affected Vendors & Products

Vendor	Product	Version / Range
EricLBuehler	mistral.rs	0.9.0
EricLBuehler	mistral.rs	0.9.1
EricLBuehler	mistral.rs	0.9.2
EricLBuehler	mistral.rs	0.9.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the mistral.rs software up to version 0.9.3. It exists in the is_global_ip function in mistralrs-server-core/src/media_source.rs where manipulation of the ip argument can lead to unauthorized server requests. The issue has been patched in version 0.9.4.

Detection Guidance

This vulnerability involves improper handling of IPv6 transition addresses in mistral.rs versions up to 0.9.3. To detect it, check if your system runs mistral.rs version 0.9.3 or earlier. Use commands like 'mistral-server --version' or inspect package managers for version details. Monitor network traffic for unexpected requests to internal or external IPs.

Impact Analysis

An attacker could exploit this to make the server send unauthorized requests to internal or external systems, potentially accessing sensitive data or services. This could lead to data breaches, unauthorized access, or disruption of services if the server processes malicious requests.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade mistral.rs to version 0.9.4 or later immediately. This addresses the SSRF vulnerability by properly validating IPv6 transition addresses. Follow the release notes at the provided GitHub URL for installation instructions. Restart services after upgrading.

Hi! I’m here to help you understand CVE-2026-108939. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70