What is the CVSS score of CVE-2026-26286?

CVE-2026-26286 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-26286?

CVE-2026-26286 affects SillyTavern, a locally installed AI interface tool, with a HIGH severity rating (CVSS 8.5) and active public exploits available.

Is there a public PoC exploit available for CVE-2026-26286?

Yes, a public proof-of-concept exploit is available for CVE-2026-26286. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26286?

Within 24 hours: Identify all instances of SillyTavern deployed across the organization and assess whether they process sensitive data or connect to production systems. Within 7 days: Implement network segmentation to isolate affected systems and restrict user access to essential personnel only; disable unnecessary features and document current usage. Within 30 days: Evaluate alternative AI interface solutions or request security update timelines from vendors; establish a formal vulnerability management process for locally installed tools not covered by standard patch management.

AI / ML CVE-2026-26286

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-19 security-advisories@github.com

SSRF AI / ML Sillytavern

8.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 20, 2026 - 19:45 vuln.today

Public exploit code

CVE Published

Feb 19, 2026 - 21:18 nvd

HIGH 8.5

DescriptionGitHub Advisory

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerability in the asset download endpoint allows authenticated users to make arbitrary HTTP requests from the server and read the full response body, enabling access to internal services, cloud metadata, and private network resources. The vulnerability has been patched in the version 1.16.0 by introducing a whitelist domain check for asset download requests. It can be reviewed and customized by editing the whitelistImportDomains array in the config.yaml file.

AnalysisAI

SillyTavern versions before 1.16.0 contain a server-side request forgery (SSRF) vulnerability in the asset download endpoint that allows authenticated users to make arbitrary HTTP requests from the server and access internal services, cloud metadata, and private network resources. Public exploit code exists for this vulnerability, which can be mitigated by upgrading to version 1.16.0 or configuring domain whitelisting in the config.yaml file.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to SillyTavern application

Delivery

Access asset download endpoint

Exploit

Craft malicious URL parameter

Execution

Server fetches internal resource

Impact

Read full HTTP response body