EUVD-2026-71122
GHSA-9mg6-c5wp-2g44
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SSRF with no auth on default config; S:C because the vulnerable component reaches internal systems outside its trust boundary; confidentiality only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.
AnalysisAI
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | MCP tool support must be active (it is enabled by default in the OGX starter configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects the threat profile: the vulnerability is remotely exploitable with no complexity requirements, requires no authentication under the default configuration, and yields high-confidentiality impact through credential exfiltration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The upstream fix is referenced in the v1.3.1 source at https://github.com/ogx-ai/ogx/blob/v1.3.1/src/ogx/providers/utils/tools/mcp.py, suggesting the corrective change extends the existing validate_url_not_private() guard to cover the server_url parameter in MCP tool definitions - operators should upgrade to v1.3.1 or later once a patched release is independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all OGX/Llama Stack deployments, prioritize internet-facing instances, and restrict network access to POST /v1/responses to trusted sources only; immediately review cloud credential access logs and IAM role assumption activity for unauthorized metadata service requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today