CVE-2026-85666
Received Received - Intake

Unauthenticated SSRF in OGX via server_url Parameter

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85666
EUVD
EUVD-2026-71122

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ogx-ai ogx to 1.3.1 (inc)
ogx ogx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OGX (formerly Llama Stack) has an unauthenticated server-side request forgery vulnerability in the POST /v1/responses endpoint. The MCP tool definitions accept a server_url parameter that is fetched server-side without validating the destination. The default configuration runs without authentication, allowing attackers to make the server connect to arbitrary internal addresses and forward headers or tokens.

Detection Guidance

Detecting this vulnerability requires checking if OGX (Llama Stack) is running with the vulnerable endpoint exposed. Inspect network traffic for POST requests to /v1/responses with server_url parameters pointing to internal or cloud metadata endpoints. Use tools like curl to test the endpoint: curl -X POST http://<target>/v1/responses -H 'Content-Type: application/json' -d '{"model": "test", "messages": [{"role": "user", "content": "test"}], "tools": [{"type": "function", "name": "test", "server_url": "http://169.254.169.254/"}]'. Monitor server logs for outbound connections to unexpected destinations.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate sensitive data, or interact with cloud metadata services. If the server has network access to internal resources, the attacker could send requests to those systems using the server as a proxy, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using OGX may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately disable the vulnerable endpoint by updating OGX to a patched version or restricting access via network policies. If authentication is not enabled, enable it immediately. Block outbound connections to internal and cloud metadata endpoints at the firewall level. Review and remove any MCP tool definitions that use server_url parameters until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart