CVE-2026-85666
ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.
| CWE | CWE-918 |
| Vendor | ogx-ai |
| Product | ogx |
| Published | Sep 4, 2026 |
| Last Updated | Sep 14, 2026 |
Get instant alerts for ogx-ai ogx
Be the first to know when new high vulnerabilities affecting ogx-ai ogx are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N