CVE-2026-85673: Server-Side Request Forgery (SSRF) in hiyouga LlamaFactory

CVE-2026-85673 is a server-side request forgery vulnerability in hiyouga's LLaMA-Factory. The vulnerability exists in the OpenAI-compatible API multimodal media URL handler, where the SSRF validation function (check_ssrf_url) validates URLs only once. However, the requests.get function follows HTTP redirects and performs DNS resolution again without reapplying the SSRF validation. This flaw allows unauthenticated attackers to exploit HTTP redirects or DNS rebinding techniques to access internal addresses and cloud metadata endpoints that should be protected from external access.

An unauthenticated attacker can bypass SSRF protections to make the server perform HTTP requests to internal network resources or cloud metadata endpoints. This could lead to unauthorized access to sensitive internal services or cloud instance metadata, potentially exposing confidential information or enabling further attacks within the internal network. The CVSS 4.0 score of 8.7 indicates a high severity vulnerability with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional network-level protections such as restricting outbound HTTP requests from the vulnerable component or applying strict URL validation that accounts for redirects and DNS rebinding. Monitor vendor channels for updates and patches.