CVE-2026-85673

LLaMA-Factory contains a server-side request forgery vulnerability (CWE-918) in the multimodal media URL handler of its OpenAI-compatible API, where the check_ssrf_url guard validates a submitted URL only once, while the subsequent requests.get call follows redirects and re-resolves DNS without re-validation. An unauthenticated attacker can submit a media URL pointing at a host they control, then use an HTTP redirect or DNS rebinding to have the server fetch an address that was never re-checked, bypassing the SSRF filter. This lets the attacker reach internal network services and cloud instance metadata endpoints (such as link-local metadata services), which can expose sensitive internal data or credentials, consistent with the high confidentiality impact and no integrity/availability impact in the CVSS 4.0 score of 8.7. Any deployment running LLaMA-Factory's OpenAI-compatible API server is affected, especially where the API is reachable by untrusted clients. Exploitation has not been observed: EPSS is 0.4% (31st percentile), the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade to the latest LLaMA-Factory release once a patched build is published and verify with the project advisory, since no fixed version is specified in this disclosure. Until then, restrict egress from API server hosts (block link-local/cloud metadata addresses such as 169.254.169.254 and internal ranges), avoid exposing the OpenAI-compatible API to untrusted networks, and review logs for media-URL requests to attacker-controlled hosts or unusual redirect/DNS behavior.