Ogx
Monthly
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.