CVE-2026-85662
Received Received - Intake

Marqo Server-Side Request Forgery in 2.26.0

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download_image_from_url and fetch_content_sample functions which lack destination filtering and host validation to access internal services and cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85662
EUVD
EUVD-2026-71118

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
marqo-ai marqo 2.26.0
marqo marqo 2.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Marqo 2.26.0 has a server-side request forgery (SSRF) vulnerability in the add_documents endpoint. Unauthenticated attackers can exploit this by providing malicious media field values to trigger requests to arbitrary URLs. The vulnerability exists because the download_image_from_url and fetch_content_sample functions lack proper destination filtering and host validation, allowing access to internal services and cloud metadata endpoints.

Detection Guidance

Check Marqo server logs for unusual outbound requests from the add_documents endpoint. Monitor network traffic for unexpected connections to internal services or cloud metadata endpoints. Inspect media field values in API requests for suspicious URLs.

Impact Analysis

This vulnerability allows attackers to make unauthorized requests to internal systems or cloud services from your Marqo server. They could access sensitive internal data, interact with other services, or probe cloud metadata endpoints for credentials or configuration details. If your Marqo instance is exposed to untrusted networks, this could lead to data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding protected health information. Organizations may face compliance violations, fines, or legal consequences if this vulnerability is exploited to access regulated data without authorization.

Mitigation Strategies

Upgrade Marqo to a patched version beyond 2.26.0. Implement strict URL validation in the add_documents endpoint. Restrict outbound network access from the Marqo server to only necessary destinations. Disable unauthenticated access if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart