TREK EUVD-2026-86338

Requires ALL of: (1) the LLM_PARSING feature explicitly enabled on the server (likely non-default); (2) an authenticated account (PR:L); (3) write permission to the target trip instance to reach the AI-assisted import path; and (4) a deployment where the server can reach internal/link-local targets (e.g. cloud metadata at 169.254.169.254). The attacker sets llm_base_url through the settings API, which is consumed by openai-compatible.client.ts, anthropic.client.ts, and ollama-format.client.ts without the SSRF guard. Limiting factors: exploitation is impossible if LLM parsing is disabled, if the attacker lacks trip write access, or if network egress/metadata endpoints are firewalled; impact is a non-blind SSRF returning only upstream error text, not arbitrary full response bodies.

This is a credible, well-substantiated SSRF (CWE-918) with all key signals aligning, though it is not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) reflects network reach and low complexity but correctly requires privileges (PR:L) - an authenticated user with write access to a trip instance. No EPSS score, CISA KEV listing, or public POC was provided, so per precision rules the status is 'no public exploit identified at time of analysis' - this is targeted/manual-effort territory rather than mass-exploitable. The most impactful signal is that this is a NON-blind SSRF: upstream error-response text is echoed back in parsing warnings, materially raising real confidentiality risk (internal service discovery, link-local cloud metadata at 169.254.169.254, potential credential leakage) compared to a blind variant. The I:H (integrity) rating rests on a speculative downstream chain - using leaked metadata credentials to later modify protected cloud resources - which is not directly demonstrated by the vulnerability itself; I regard I:H as somewhat inflated. Exploitation is further gated by the LLM_PARSING feature being enabled (likely non-default) and by trip-instance write permission, so real-world exposure is narrower than the 8.1 headline suggests. Net: a genuine, verifiable priority for any deployment that enables LLM parsing and runs in a cloud environment with reachable metadata endpoints, but bounded by authentication and feature-flag prerequisites.

An authenticated TREK user with write access to a trip, on an instance where the LLM_PARSING feature is enabled, sets a malicious llm_base_url (e.g. http://169.254.169.254/latest/meta-data/iam/security-credentials/) via the settings API. They then trigger AI-assisted trip import, causing the server to issue an outbound request to that destination; because the SSRF guard is not applied, and because upstream error text is surfaced in parsing warnings, the attacker reads internal service responses and cloud metadata. No public POC was provided.