CVE-2026-26286

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerability in the asset download endpoint allows authenticated users to make arbitrary HTTP requests from the server and read the full response body, enabling access to internal services, cloud metadata, and private network resources. The vulnerability has been patched in the version 1.16.0 by introducing a whitelist domain check for asset download requests. It can be reviewed and customized by editing the `whitelistImportDomains` array in the `config.yaml` file.

An attacker with any valid SillyTavern account (or access to a shared/public instance) crafts a malicious asset download request targeting http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted VM. The server fetches the URL and returns the full response—including temporary IAM access key, secret, and session token. The attacker uses those credentials to enumerate S3 buckets (potentially containing training data, model weights, or proprietary datasets), pivot to other AWS services, or escalate privileges. In a multi-tenant or team deployment, any low-privileged user can execute this without any social engineering or additional exploitation steps.