LLaMA-Factory EUVD-2026-71129

The LLaMA-Factory OpenAI-compatible API must be running and network-accessible to the attacker - typically exposed on a local or cloud host port (default 8000). The multimodal media URL handler must be reachable, meaning the API is started in a mode that processes image or video URL inputs (standard for vision-capable model deployments). No authentication is required per the CVSS PR:N metric. For the HTTP redirect variant, the attacker needs only a simple HTTP server that issues a 30x redirect to an internal address - trivially automated. For the DNS rebinding variant, the attacker must control a DNS server and wait for the LLaMA-Factory server's DNS cache TTL to expire between the validation check and the fetch. Cloud metadata exfiltration (the highest-impact path) additionally requires that AWS IMDSv1, Azure IMDS, or GCP metadata endpoints are reachable from the host running LLaMA-Factory and that IMDSv2 enforcement is not in place. Strict outbound egress firewall rules blocking metadata IP ranges would prevent this specific impact but not all SSRF targets.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.7, reflecting unauthenticated network exploitation with high confidentiality impact and no integrity or availability consequence. The primary real-world risk is cloud credential exfiltration: in AWS, Azure, or GCP deployments running LLaMA-Factory with IMDSv1 enabled, a successful SSRF can retrieve IAM access keys, enabling lateral movement across the cloud account. HTTP redirect exploitation is low-complexity - it requires only an attacker-controlled HTTP server and is easily automatable. DNS rebinding is higher complexity, requiring attacker DNS infrastructure and timing within the TTL window, but is a well-understood technique with available tooling. No EPSS score is provided in the input data, and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. VulnCheck published an advisory, suggesting at least rudimentary public documentation of the technique exists. The impact is bounded by read-only SSRF - no write capability is established - but credential theft via cloud metadata can effectively escalate to full cloud account compromise. Deployments not on cloud infrastructure with strict egress controls face reduced risk.

An attacker sends a POST request to the LLaMA-Factory OpenAI-compatible chat completions endpoint with a multimodal message containing an image URL pointing to an attacker-controlled server. The check_ssrf_url guard validates the URL as a public address and permits the request; the attacker's server then returns an HTTP 301 redirect targeting http://169.254.169.254/latest/meta-data/iam/security-credentials/. Python's requests.get follows the redirect without re-invoking the SSRF guard, fetching the cloud IAM role name, and a subsequent redirect yields the full access key ID, secret, and session token, which the API incorporates into or returns alongside the model response. No public exploit code is confirmed at time of analysis, but the technique is well-documented in existing SSRF research.