CVE-2026-85666: Server-Side Request Forgery (SSRF) in ogx-ai ogx
Description
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.
CVSS v4.0
Score 8.7high
Affected software
ogx-ai
ogx
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85666 is an SSRF vulnerability in ogx-ai's ogx product affecting versions from 0 up to and including 1.3.1. The vulnerability exists in the POST /v1/responses endpoint where the server_url parameter is used without applying the validate_url_not_private() guard, which is applied to other URL inputs. This allows unauthenticated remote attackers to cause the server to open connections to arbitrary internal network addresses, including sensitive cloud metadata endpoints like http://169.254.169.254/, potentially exposing internal data or enabling further attacks.
Potential Impact
An unauthenticated remote attacker can exploit this SSRF vulnerability to make the server connect to arbitrary internal network addresses. This can lead to unauthorized access to internal services, including cloud metadata endpoints, which may expose sensitive information such as credentials or configuration data. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating a significant risk if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the vulnerable endpoint, apply network-level controls to limit server outbound requests, and avoid running the default starter configuration without authentication. Monitor vendor channels for official patches or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-04T13:32:29.698Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9adb45acd9273b49bef58f
Added to database: 09/04/2026, 14:52:53 UTC
Last enriched: 09/14/2026, 22:40:43 UTC
Last updated: 10/18/2026, 06:48:20 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.