CVE-2026-77294: TREK: SSRF via llm_base_url exposes cloud metadata

HIGHCISA: ATTEND

Published September 24, 2026

CISO Take

TREK, a collaborative travel planner with an optional LLM-assisted import feature, lets any authenticated user with trip write access set an arbitrary LLM endpoint URL that the server then requests without SSRF protection, and error text from the target can be echoed back in parsing warnings. That makes it a practical route to internal service discovery and to link-local cloud metadata (e.g., 169.254.169.254), which can yield infrastructure credentials and enable changes to cloud resources, hence the high CVSS of 8.1 with high confidentiality and integrity impact. Likelihood is moderate rather than urgent: EPSS is low (0.00308, 78th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and SSVC says ATTEND. Exposure is limited to deployments with LLM_PARSING enabled and users who hold low-privilege accounts. Upgrade to TREK 3.3.0 or later, enforce IMDSv2 or block metadata access at the network layer, and review cloud audit logs for credentials used from unexpected sources.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 8.1) but moderate real-world likelihood. Exploitation needs only low-privilege authentication plus write access to a trip, with no user interaction and low complexity. The blast radius depends on the hosting environment: on cloud VMs or containers with reachable metadata services and over-privileged instance roles, impact can escalate from SSRF to cloud account compromise. EPSS is low (0.00308), there is no KEV listing, no public exploit and no scanner template, so mass exploitation is not currently observed. Deployments with LLM_PARSING disabled are not exposed through this path. The echo of upstream error text in parsing warnings makes it a non-blind SSRF, which raises its value to attackers.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account that has write access to a trip.

AML.T0012

Configuration Tampering

Attacker sets llm_base_url via the settings API to an internal or metadata address, which bypasses the SSRF guard.

AML.T0049

SSRF Trigger

Attacker runs AI-assisted trip parsing so the server requests the destination and returns upstream error text in parsing warnings.

AML.T0075

Impact

Attacker harvests cloud metadata credentials and uses them to access or modify protected cloud resources.

AML.T0055

Initial Access

Attacker authenticates with a low-privilege account that has write access to a trip.

AML.T0012

Configuration Tampering

Attacker sets llm_base_url via the settings API to an internal or metadata address, which bypasses the SSRF guard.

AML.T0049

SSRF Trigger

Attacker runs AI-assisted trip parsing so the server requests the destination and returns upstream error text in parsing warnings.

AML.T0075

Impact

Attacker harvests cloud metadata credentials and uses them to access or modify protected cloud resources.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TREK	—	—	No patch

Do you use TREK? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade TREK to version 3.3.0 or later (fix in PR #1520 and commit 19064b3). 2) If you cannot patch immediately, disable the LLM_PARSING feature or restrict who can modify settings and trip write access. 3) Enforce IMDSv2 with a hop limit of 1, or block egress to 169.254.169.254 and internal ranges from the TREK host or container via firewall or egress proxy. 4) Apply least privilege to instance or workload roles so leaked credentials have minimal blast radius. 5) Detection: audit settings API changes to llm_base_url, look for TREK server outbound requests to internal or link-local addresses, review parsing warnings that contain unexpected upstream error text, and check cloud audit logs (e.g., CloudTrail) for instance credentials used from external IPs. 6) Rotate any credentials that may have been exposed.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAPIFrameworkAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery AML.T0096- AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain / Insecure IntegrationLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77294?

Is CVE-2026-77294 actively exploited?

No confirmed active exploitation of CVE-2026-77294 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77294?

1) Upgrade TREK to version 3.3.0 or later (fix in PR #1520 and commit 19064b3). 2) If you cannot patch immediately, disable the LLM_PARSING feature or restrict who can modify settings and trip write access. 3) Enforce IMDSv2 with a hop limit of 1, or block egress to 169.254.169.254 and internal ranges from the TREK host or container via firewall or egress proxy. 4) Apply least privilege to instance or workload roles so leaked credentials have minimal blast radius. 5) Detection: audit settings API changes to llm_base_url, look for TREK server outbound requests to internal or link-local addresses, review parsing warnings that contain unexpected upstream error text, and check cloud audit logs (e.g., CloudTrail) for instance credentials used from external IPs. 6) Rotate any credentials that may have been exposed.

What systems are affected by CVE-2026-77294?

This vulnerability affects the following AI/ML architecture patterns: LLM API integrations, AI-assisted import/parsing pipelines, Self-hosted web applications with LLM backends, Cloud-hosted containerized deployments.

What is the CVSS score for CVE-2026-77294?

CVE-2026-77294 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

LLM API integrationsAI-assisted import/parsing pipelinesSelf-hosted web applications with LLM backendsCloud-hosted containerized deployments

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

AML.T0096AI Service API

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted import path. The value is consumed by the clients in server/src/nest/llm-parse/clients/openai-compatible.client.ts, server/src/nest/llm-parse/clients/anthropic.client.ts, and server/src/nest/llm-parse/router/ollama-format.client.ts without applying the server-side request forgery guard. Triggering AI-assisted trip parsing causes the server to request the supplied destination, and upstream error response text can be returned in parsing warnings. This permits internal service discovery and access to link-local cloud metadata, with possible disclosure of infrastructure credentials and subsequent modification of protected cloud resources. This issue is fixed in version 3.3.0.

Exploitation Scenario

An attacker with a low-privilege TREK account, or write access to a shared trip, sets llm_base_url through the settings API to http://169.254.169.254/latest/meta-data/iam/security-credentials/. They then trigger AI-assisted trip import. The server sends the request using one of the unguarded LLM clients and returns the metadata or the error response in the parsing warnings. The attacker retrieves the role name, repeats the call for the credential path to obtain temporary cloud credentials, and then uses them externally to access or modify cloud resources such as storage buckets or other services. The same technique can be used to scan internal services.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.