vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery

The SSRF vulnerability in vanna-ai vanna allows an attacker to craft malicious requests that the application will then execute on behalf of the server. This can lead to several severe consequences. An attacker could potentially access sensitive internal resources that are not directly exposed to the internet, such as configuration files, database credentials, or internal APIs. They might also be able to scan internal networks for other vulnerable services or launch attacks against them. Given the public availability of an exploit, the blast radius is significant, and rapid exploitation is likely. The lack of vendor response further exacerbates the risk.

Organizations deploying vanna-ai vanna in environments with internal resources accessible via HTTP or HTTPS are at significant risk. This includes development environments, staging servers, and production deployments. Shared hosting environments where multiple users share the same vanna-ai vanna instance are particularly vulnerable, as a compromise of one user's account could potentially lead to the compromise of the entire system.

• python / server:

  journalctl -u vanna -f | grep -i "server-side request forgery"

• generic web:

  curl -I http://your-vanna-instance/update_sql/run_sql?url=http://internal-resource | grep "Internal Server Error"

1. 2026-03-16Disclosure

   disclosure

1. Gereserveerd2026-03-15
2. Gepubliceerd2026-03-16
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-4231 is to upgrade to a patched version of vanna-ai vanna as soon as it becomes available. Until a patch is released, implement temporary workarounds to reduce the attack surface. A Web Application Firewall (WAF) can be configured to block suspicious requests that attempt to access internal resources. Specifically, WAF rules should be implemented to filter requests based on the target URL, restricting access to known internal IP addresses or domains. Additionally, input validation and sanitization on the updatesql/runsql function can help prevent malicious URLs from being processed. Monitor application logs for unusual outbound requests.