CVE-2026-86237
Received Received - Intake

Server-Side Request Forgery in OpenAgents SDK

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulDB

Description
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86237
EUVD
EUVD-2026-72185

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openagents-org openagents to 0.9.3.post20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86237 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the OpenAgents HTTP Transport component. It affects the test_default_model function in sdk/src/openagents/sdk/transports/http.py. The vulnerability allows attackers to manipulate the base_url parameter in the POST /api/admin/default-model/test endpoint, which is not protected by authentication. This enables the attacker to send HTTP requests to arbitrary internal or external URLs, including cloud metadata services, private networks, or localhost.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unusual POST requests to /api/admin/default-model/test with custom or openai-compatible provider and arbitrary base_url values. Check logs for connections to internal IPs (RFC1918), localhost, or cloud metadata endpoints (e.g., 169.254.169.254 for AWS). Use tools like curl to test the endpoint: curl -X POST http://<target>/api/admin/default-model/test -H 'Content-Type: application/json' -d '{"provider":"custom","base_url":"http://169.254.169.254/latest/meta-data/"}'.

Impact Analysis

This vulnerability allows attackers to perform SSRF attacks, which can lead to unauthorized access to sensitive data, internal network scanning, and exploitation of internal APIs. Attackers could target cloud metadata services to steal credentials, scan internal networks for vulnerable services, or access localhost services to compromise the system. The impact includes potential data theft, system compromise, and unauthorized network reconnaissance.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, internal systems, or cloud metadata, which may violate GDPR's data protection requirements (e.g., unauthorized data access or processing) and HIPAA's safeguards for protected health information (e.g., unauthorized network access to PHI systems).

Mitigation Strategies

Immediately restrict access to the /api/admin/default-model/test endpoint by adding authentication checks. Implement a URL allowlist to block requests to internal IPs (RFC1918), localhost, and cloud metadata endpoints. Enforce HTTPS-only connections and add DNS rebinding protections. Update to a patched version once available or apply the maintainer's suggested fix by adding _require_admin() to the endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart