AI 安全
knowns Discloses Eight Vulnerabilities at Once: Version 0.30.0 Fixes Admin Interface, but Latest Release Still Has SSRF
New security records for knowns, an AI project memory tool, show that older versions bound an unauthenticated administrative API to all network interfaces by default and contained path traversal, command injection, and MCP authorization bypass vulnerabilities. Most issues were fixed in version 0.30.0, but the model testing endpoint in version 0.33.0 can still send requests to arbitrary addresses, with no confirmed patched release available.
Eight security advisories for knowns, an AI-native development memory layer, appeared together on September 8. Rather than prompt-based attacks against models, they expose failures in the traditional trust boundaries of services surrounding AI agents. The most severe vulnerability, CVE-2026-86543, received a CVSS 4.0 score of 9.3. On fresh installations before version 0.30.0, the administrative API listened on all interfaces by default and required no password. An attacker could call `/api/tunnel/start` to establish a public tunnel, republishing to the internet a service intended only for local use that stores source code and project knowledge.
The same group of issues also includes path traversal vulnerabilities in template, document, and memory tools; command injection through an LSP executable specified in a configuration file; and insufficient authorization checks in `code.replace`. The project had already released version 0.30.0 on August 16, adding path containment, guards for code modifications, browser interface authentication, and restrictions on outbound connections. However, the complete CVE records did not enter public databases until this week, meaning deployment pipelines that scan only npm or pip package manifests may not have received timely warnings.
More troubling is CVE-2026-86539: in version 0.33.0, `POST /api/embedding-models/test` still accepts a caller-specified destination and connects to it on the caller’s behalf. Returned transport errors can be used to probe internal network hosts or cloud metadata endpoints. The advisory does not identify a released patched version, and the project’s release notes and the new vulnerability data do not fully agree on the scope of the SSRF fix.
Engineering teams should upgrade to at least version 0.33.0, verify that the service is bound only to loopback or a controlled management network, and use firewall rules to block metadata IP addresses as well as unnecessary east-west and outbound traffic. If an older instance was ever exposed to an untrusted network, teams should also review tunnel, LSP, and file-modification logs and rotate any credentials that may have been exposed through a metadata service. The next development to watch is whether the project releases a version explicitly covering CVE-2026-86539; teams should not rely solely on the advisory page’s “patched version” field.