ms-swift EUVD-2026-71135

The ms-swift deploy API must be running and network-accessible to the attacker - this is explicitly the intended use case of the deploy subcommand, which starts the OpenAI-compatible inference server. No authentication is required (PR:N confirmed by CVSS vector). No special feature flags or non-default configuration is needed; multimodal URL input is a core feature of the API. Exploitation is limited in practice to deployments where the inference server is exposed beyond a localhost or isolated intranet boundary. Attackers must be able to reach the API port (typically 8000 or similar). The usefulness of the SSRF is further gated on what internal services are reachable from the server host - cloud-hosted deployments with accessible IMDS are at highest risk; air-gapped or localhost-only deployments are not meaningfully exposed.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the threat model: any unauthenticated attacker who can reach the deploy API endpoint can immediately begin probing internal infrastructure. The high confidentiality impact is well-founded given cloud IMDS credential theft scenarios. The absence of KEV listing and no confirmed POC code reduces urgency somewhat, but the technique (SSRF via URL parameter) is trivially reproducible by any competent attacker without tooling - even a mid-sized municipal IT team in leszno operating an internal AI deployment should treat this as urgent if the ms-swift deploy API is reachable beyond a trusted subnet. EPSS data is not present in the input, so exploitation probability cannot be quantified numerically. The wildcard CPE version range means the precise affected scope is uncertain, which is a gap in the available data. No integrity or availability impact is scored, which is consistent with a pure SSRF read path unless SSRF-to-RCE chaining via internal services is possible (not confirmed by available data).

An attacker sends an unauthenticated POST request to the ms-swift deploy API's chat completions endpoint, supplying an image_url of http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the image content. The server fetches this URL and returns the AWS IAM role credentials in the API response, which the attacker captures and uses to authenticate to AWS services. No authentication, credentials, or prior access to the target environment is required beyond network reachability to the deploy API port.