EUVD-2026-44953
GHSA-c6cx-mj2w-vjcr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF with scope change; confidentiality high via cloud credential theft; no integrity or availability impact on vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content. The fetch_image function in router/src/validation.rs performs no validation of private, loopback, link-local, or cloud metadata target addresses, and the reqwest HTTP client follows redirects by default, enabling attackers to bypass scheme checks via redirect chains to reach internal services and cloud instance-metadata endpoints for internal port scanning and credential theft.
AnalysisAI
Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP GET requests via a crafted image_url value submitted to the OpenAI-compatible multimodal chat completions endpoint. The fetch_image function in router/src/validation.rs applies no destination validation, and the reqwest client's default redirect-following behavior allows attackers to chain redirects to bypass any scheme-level controls, reaching cloud instance-metadata services (e.g., AWS IMDSv1 at 169.254.169.254) to steal IAM credentials or enumerate internal port services. Publicly available exploit code exists (VulnCheck/geo-chen); no KEV listing at time of analysis, but the combination of unauthenticated access, cloud credential theft potential, and working POC makes this a genuine priority for any cloud-hosted TGI deployment.
Technical ContextAI
text-generation-inference (TGI) is HuggingFace's production LLM inference server, written in Rust with a router component (router/src/validation.rs) that implements an OpenAI-compatible chat completions API supporting multimodal content including image URLs. The vulnerability stems from the fetch_image function failing to validate image_url destinations against RFC 1918 private ranges, loopback addresses, link-local ranges (169.254.0.0/16), and cloud metadata endpoints prior to fetching. The underlying HTTP client, reqwest, follows HTTP redirects by default, which enables attackers to submit a URL to an attacker-controlled host that issues a 302 redirect to an internal target - effectively bypassing any scheme or host prefix checks that may be applied before the fetch. CWE-918 (Server-Side Request Forgery) describes this root-cause class precisely: the server is weaponized into acting as a proxy for attacker-directed requests to otherwise inaccessible internal resources. The CPE string cpe:2.3:a:huggingface:text-generation-inference:*:*:*:*:*:*:*:* confirms all tracked releases are affected through 3.3.7.
RemediationAI
No vendor-released patch version is independently confirmed at time of analysis - the affected CPE range covers all versions through 3.3.7 without specifying a fixed release. Operators should monitor the HuggingFace text-generation-inference GitHub repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/text-generation-inference-ssrf-via-fetch-image-in-multimodal-chat-completions for a patched release and apply it immediately upon availability. As compensating controls, the highest-priority action is to disable the OpenAI-compatible multimodal chat completions endpoint entirely if image URL inputs are not operationally required, eliminating the attack surface with no functional impact to text-only use cases. Where multimodal input is required, deploy network-level egress filtering on the TGI host to block outbound HTTP requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local ranges (169.254.0.0/16) - note that filtering must be enforced at the network layer since the redirect-following behavior means application-layer URL validation alone is bypassable. For cloud deployments on AWS, enforce IMDSv2 (token-required mode) on all EC2 instances running TGI; this prevents IMDSv1 credential theft even if SSRF is successfully exploited, though it does not prevent internal port scanning. Placing TGI behind an authenticating reverse proxy or API gateway restricts who can reach the multimodal endpoint and is advisable regardless of this CVE.
More in Hugging Face
View allThe huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository,
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim process
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, spe
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
Unauthenticated remote code execution in HuggingFace LeRobot (versions 0 through 0.5.1) stems from pickle.loads() being
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, sp
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today