CVE-2026-85686

ms-swift 4.5.2 contains a server-side request forgery flaw (CWE-918) in the OpenAI-compatible API exposed by 'swift deploy', where the server fetches multimodal media URLs supplied in chat requests without validating destinations or filtering redirects. An unauthenticated attacker can submit arbitrary image_url, audio_url, or video_url parameters, causing the server to issue HTTP requests to attacker-chosen targets. Because requests originate from the model-serving host, the attacker can reach internal-only services and cloud instance metadata endpoints (e.g., link-local metadata addresses), and the high confidentiality rating of the CVSS score reflects the potential to read internal data or cloud credentials. Any operator running ms-swift 4.5.2 with 'swift deploy' accepting requests from untrusted clients is affected. Exploitation is not currently observed: the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days, and no public proof-of-concept is known.

What to do: Upgrade ms-swift to a release newer than 4.5.2 once a patched version is published, since the advisory data does not specify a fixed version. Until then, restrict egress from 'swift deploy' hosts (especially blocking link-local cloud metadata addresses such as 169.254.169.254 and internal service ranges), avoid passing untrusted media URLs to the multimodal API, and place the OpenAI-compatible endpoint behind authentication or an internal network rather than exposing it publicly.