CVE-2026-108719: Server-Side Request Forgery (SSRF) in theopenco LLMGateway

CVE-2026-108719 describes a blind SSRF vulnerability in theopenco's LLMGateway through version 1.20.0. The issue arises because the video-generation callback_url extension does not enforce the assertSafeWebhookTarget check, allowing API key holders to supply URLs pointing to loopback, private, or cloud metadata endpoints. This enables attackers to cause the system to send webhook POST requests to internal hosts accessible from the worker's network, potentially exposing internal services.

An attacker with an API key can exploit this SSRF vulnerability to reach internal network hosts that are normally inaccessible externally. This could lead to unauthorized interactions with internal services, potentially exposing sensitive information or enabling further attacks within the internal network. However, the vulnerability requires API key access and does not allow direct remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API key distribution and monitor usage to prevent abuse of the callback_url extension. Avoid using untrusted URLs in the video-generation callback_url parameter.