CVE-2026-85662

Marqo 2.26.0 contains a server-side request forgery vulnerability in the add documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download image from url and fetch content sample functions which lack destination filtering and host validation to access internal services and cloud metadata endpoints.