TREK versions before 3.3.0 contain an SSRF vulnerability (CWE-918) where an authenticated user with write access to a trip instance can control the llm_base_url setting if the LLM_PARSING feature is enabled. This setting is consumed by server-side clients (openai-compatible.client.ts, anthropic.client.ts, ollama-format.client.ts) without applying SSRF guards. Triggering AI-assisted trip parsing causes the server to make HTTP requests to the attacker-controlled URL, which can return upstream error responses visible in parsing warnings. This allows attackers to perform internal service discovery and access link-local cloud metadata endpoints, risking exposure of infrastructure credentials and unauthorized modification of cloud resources. The vulnerability is resolved in TREK version 3.3.0.

An attacker with authenticated write access to a trip instance can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This can lead to internal network reconnaissance and access to sensitive cloud metadata services, potentially disclosing infrastructure credentials. Such credentials could be used to modify protected cloud resources, posing a significant security risk. The CVSS score of 8.1 reflects high impact on confidentiality and integrity, with no impact on availability.

Upgrade TREK to version 3.3.0 or later, where this SSRF vulnerability is fixed. Until the upgrade, restrict write permissions on trip instances to trusted users and consider disabling the LLM_PARSING feature if not required. No other mitigations are specified by the vendor advisory.