CVE-2026-108939 json
EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery
published 2026-10-12 27 d ago modified 2026-10-15 24 d ago also EUVD-2026-98092
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function is_global_ip of the file mistralrs-server-core/src/media_source.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.9.4 is recommended to address this issue. The name of the patch is cfb8c6a0c42361dc4579a9110b54d339c255b9fd. The affected component should be upgraded.
Patch / fix
- EricLBuehler mistral.rs 0.9.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 24 d ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- EricLBuehler mistral.rs
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/EricLBuehler/mistral.rs/commit/cfb8c6a0c
patch
-
github.com
/EricLBuehler/mistral.rs/pull/2446
issue-tracking, patch
-
github.com
/EricLBuehler/mistral.rs/commit/cfb8c6a0c42361dc4579a9110b54d339c255b9fd
patch
-
github.com
/EricLBuehler/mistral.rs/releases/tag/v0.9.4
patch
-
vuldb.com
/vuln/416763
vdb-entry, technical-description
-
vuldb.com
/vuln/416763/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-108939
third-party-advisory
-
vuldb.com
/submit/997600
third-party-advisory
-
github.com
/EricLBuehler/mistral.rs/
product
Sources
- CVE List CVE-2026-108939
- NVD CVE-2026-108939
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.