Unauthenticated Server-Side Request Forgery in OGX by OGX AI

CVE-2026-85666

What is CVE-2026-85666?

OGX, previously known as Llama Stack, has revealed a critical server-side request forgery vulnerability that affects its unauthenticated POST /v1/responses endpoint. In the default configuration, when the MCP tool definitions are utilized, the server_url parameter can be manipulated by malicious actors. The lack of adequate destination validation allows attackers to make the server connect to arbitrary internal addresses, potentially exposing sensitive data, including cloud metadata that could grant access to secure environments. The underlying issue arises from the absence of the validate_url_not_private() guard, which is typically employed for other URL inputs. As a result, this vulnerability poses a significant risk to users operating with the default configurations.

References