Text Generation Inference EUVD-2026-44953

The OpenAI-compatible multimodal chat completions endpoint must be network-accessible to the attacker, which is default behavior when TGI is deployed as a public or semi-public inference API. No authentication is required per CVSS PR:N - any client able to reach the endpoint can trigger the SSRF. The attack is structurally limited to outbound HTTP GET requests only; the server cannot be made to issue POST requests or mutate internal services. Full credential-theft impact is conditional on the TGI deployment having network access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254) or internal HTTP APIs - TGI instances on isolated VPCs with strict egress filtering or IMDSv2-only enforcement face reduced practical impact. The redirect-following behavior of reqwest means any partial URL filtering applied at the application layer is bypassable via a redirect chain through an attacker-controlled intermediate host. Deployments behind an authenticated reverse proxy that requires valid credentials before reaching TGI significantly limit exploitation to authenticated users.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N) accurately captures the threat profile: no authentication is required, network exploitation is straightforward, but the AT:P modifier reflects that full subsequent-system impact (SC:H) depends on the TGI server's network reachability to cloud metadata endpoints or internal HTTP services. In practice, TGI is most commonly deployed in cloud GPU environments (AWS, GCP, Azure) where IMDSv1 is often still reachable unless explicitly disabled - exactly the deployment profile where credential theft impact materializes. The VC:N/VI:N/VA:N metrics confirm the TGI host itself is not directly compromised; risk is entirely to adjacent systems. A publicly available proof-of-concept lowers exploitation barrier significantly, though the absence of a CISA KEV listing at time of analysis suggests exploitation has not yet been observed at scale. The redirect-chain bypass technique means naive allowlisting of URL schemes or host prefixes is insufficient as a standalone control. No EPSS data was provided in the input; given POC availability and cloud-deployment prevalence, real-world exploitation probability should be considered elevated above the raw CVSS score implies.

An unauthenticated attacker sends a POST request to the TGI multimodal chat completions endpoint with a chat message containing an image_url set to an attacker-controlled server. That server responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/, causing TGI's reqwest client to follow the redirect and return the AWS IAM role credentials in the server's response. A publicly available proof-of-concept at https://github.com/geo-chen/oss/blob/main/text-generation-inference.md demonstrates this redirect-chain technique to bypass scheme checks and reach internal metadata endpoints.