Modelscope CVE-2026-6606

The vulnerability requires the AgentScope application to be deployed with the audio processing feature enabled and accessible over the network. Attack requires network access to the HTTP interface of the application (typically port 8000-8500 or custom). No authentication is required due to PR:N (unauthenticated). The _process_audio_block function must be reachable via API; if this endpoint is not exposed (e.g., if audio processing is disabled or the service is only accessible internally), exploitation is prevented. Non-default configurations that restrict outbound network access from the application would also limit exploitation. The vulnerability is not triggered by simply running AgentScope; it requires an attacker to actively send a request to the audio processing endpoint with a malicious URL parameter, and the application must be configured to accept and process such requests.

The CVSS v4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N indicates network-accessible, unauthenticated exploitation with low complexity and no attack target complexity or user interaction required. The 'E:P' designation confirms publicly available exploit code. Confidentiality, Integrity, and Availability are each rated as Low (VC:L/VI:L/VA:L), suggesting limited direct impact on the attacked system itself, which is consistent with SSRF vulnerabilities that typically pivot to other services rather than compromising the primary target. However, SSRF severity depends critically on network topology: if the vulnerable server can reach internal APIs, cloud metadata endpoints, or other sensitive services, real-world risk is substantially higher than the base CVSS suggests. The lack of vendor response and availability of public POC elevates operational risk significantly. EPSS score is not provided, but given the public POC and low exploitation barriers (AV:N/AC:L/PR:N), real-world exploitation probability is high. The vulnerability is NOT confirmed in CISA KEV, indicating no confirmed active exploitation in the wild at time of analysis, but the presence of public POC code means exploitation is technically trivial.

An attacker sends a specially crafted HTTP POST request to the AgentScope audio processing endpoint, including a malicious 'url' parameter pointing to an internal service (e.g., http://localhost:8080/admin or http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity). The vulnerable _process_audio_block function fails to validate this URL and instead makes an HTTP request from the server to the attacker-specified destination, leaking sensitive information from internal APIs or cloud metadata services back to the attacker.