CVE-2026-85666

OGX (formerly Llama Stack), at commit fbe8e0f, contains an unauthenticated server-side request forgery vulnerability (CWE-918, CVSS 4.0 8.7 High) in its OpenAI-compatible POST /v1/responses endpoint. The flaw is triggered when an attacker supplies an MCP tool definition with a server_url parameter (along with headers and authorization values) that the server fetches itself without any destination validation; the validate_url_not_private() guard applied to other URL inputs is not enforced for this parameter. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can make the server open connections to arbitrary internal addresses, including cloud metadata services such as http://169.254.169.254/, and forward attacker-controlled headers and bearer tokens to those destinations, potentially harvesting instance credentials or probing internal networks. Any deployment running the affected code is exposed, with the greatest risk on unauthenticated, internet-reachable default starter setups. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.4% (percentile 35), so exploitation is not currently known to be occurring.

What to do: Audit OGX/Llama Stack deployments to determine whether POST /v1/responses is reachable without authentication and whether clients can submit MCP tool definitions with arbitrary server_url values. Mitigate by requiring authentication on the endpoint, restricting server_url to an allowlist of external hosts or applying private-address/metadata filtering (including blocking 169.254.169.254) for server-side fetches, and monitoring for a vendor fix in commits after fbe8e0f.