CVE-2026-85673: LLaMA Factory SSRF guard bypass

CISO Take

LLaMA-Factory's OpenAI-compatible API validates media URLs for SSRF once via check_ssrf_url, but the underlying requests.get call follows HTTP redirects and re-resolves DNS without re-checking the destination, letting an unauthenticated attacker redirect the initial fetch — or rebind DNS after the check passes — to internal services or cloud metadata endpoints like 169.254.169.254. This is a CVSS 7.5, network-exploitable, no-auth, no-user-interaction flaw with a pure confidentiality impact, and while there's no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, SSRF-to-metadata is a well-worn technique that reliably yields cloud credentials once discovered. The blast radius is unclear (downstream dependents and package risk score are not populated), but any team exposing LLaMA-Factory's multimodal chat completions API — common in self-hosted fine-tuning and serving setups — should treat this as reachable from the internet. No fixed version is referenced beyond the vulnerable v0.9.5, so until a patch lands, block egress to link-local/RFC1918 ranges from the host running the API, enforce IMDSv2 with a hop limit of 1 on cloud instances, and disable the multimodal media-URL feature if it isn't in active use. Monitor API and network logs for outbound requests to 169.254.169.254 or unexpected internal IPs as a detection signal.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High severity (CVSS 7.5) driven by network attack vector, low complexity, no privileges or user interaction required, and a confidentiality-only impact typical of SSRF. Exploitability is realistic but not trivial: the attacker needs to control a media URL parameter and either operate a redirect-capable host or execute DNS rebinding, both well-documented techniques with public tooling. There is no EPSS score, no CISA KEV listing, no public PoC, and no Nuclei template, so there is currently no evidence of active exploitation — but the underlying pattern (validate-then-fetch without re-validation on redirect) is a classic, reliable SSRF bypass, and cloud metadata endpoints remain a high-value, low-effort target once reachable. Exposure is unauthenticated and internet-facing wherever the OpenAI-compatible API is deployed without network-layer egress restrictions.

How does the attack unfold?

Initial Access

Unauthenticated attacker sends a request to LLaMA-Factory's exposed OpenAI-compatible chat completions API with a multimodal media URL pointing to an attacker-controlled host that passes the initial SSRF check.

AML.T0049

SSRF Guard Bypass

requests.get follows an HTTP redirect or resolves a rebound DNS entry to an internal address or cloud metadata endpoint without re-running check_ssrf_url.

AML.T0040

Data Exfiltration

The API server fetches the internal resource (e.g., cloud IAM credentials from metadata service), and the response content is exposed to the attacker via output, logs, or errors.

AML.T0025

Initial Access

Unauthenticated attacker sends a request to LLaMA-Factory's exposed OpenAI-compatible chat completions API with a multimodal media URL pointing to an attacker-controlled host that passes the initial SSRF check.

AML.T0049

SSRF Guard Bypass

requests.get follows an HTTP redirect or resolves a rebound DNS entry to an internal address or cloud metadata endpoint without re-running check_ssrf_url.

AML.T0040

Data Exfiltration

The API server fetches the internal resource (e.g., cloud IAM credentials from metadata service), and the response content is exposed to the attacker via output, logs, or errors.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LLaMA Factory	pip	—	No patch

Do you use LLaMA Factory? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

Track the upstream fix referenced in GitHub issue hiyouga/LlamaFactory#10646 and the VulnCheck advisory, and upgrade past v0.9.5 as soon as a patched release is available. Until then, apply defense-in-depth at the network layer: block egress from the host/container running the API to 169.254.169.254 and RFC1918 address ranges, enforce IMDSv2 with a hop limit of 1 on any cloud instance running the service, and place the API behind a proxy that performs its own strict SSRF filtering with redirect-following disabled. If the multimodal media-URL ingestion feature is not required, disable it entirely. For detection, alert on outbound requests from the LLaMA-Factory process to link-local or internal-only IP ranges and on unexpected redirect chains in application logs.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData ExtractionAPIInferenceAML.T0025- Exfiltration via Cyber Means AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system security

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated and documented

OWASP LLM Top 10

LLM-SSRF-Server-Side Request Forgery

Frequently Asked Questions

What is CVE-2026-85673?

LLaMA-Factory's OpenAI-compatible API validates media URLs for SSRF once via check_ssrf_url, but the underlying requests.get call follows HTTP redirects and re-resolves DNS without re-checking the destination, letting an unauthenticated attacker redirect the initial fetch — or rebind DNS after the check passes — to internal services or cloud metadata endpoints like 169.254.169.254. This is a CVSS 7.5, network-exploitable, no-auth, no-user-interaction flaw with a pure confidentiality impact, and while there's no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, SSRF-to-metadata is a well-worn technique that reliably yields cloud credentials once discovered. The blast radius is unclear (downstream dependents and package risk score are not populated), but any team exposing LLaMA-Factory's multimodal chat completions API — common in self-hosted fine-tuning and serving setups — should treat this as reachable from the internet. No fixed version is referenced beyond the vulnerable v0.9.5, so until a patch lands, block egress to link-local/RFC1918 ranges from the host running the API, enforce IMDSv2 with a hop limit of 1 on cloud instances, and disable the multimodal media-URL feature if it isn't in active use. Monitor API and network logs for outbound requests to 169.254.169.254 or unexpected internal IPs as a detection signal.

Is CVE-2026-85673 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-85673, increasing the risk of exploitation.

How to fix CVE-2026-85673?

Track the upstream fix referenced in GitHub issue hiyouga/LlamaFactory#10646 and the VulnCheck advisory, and upgrade past v0.9.5 as soon as a patched release is available. Until then, apply defense-in-depth at the network layer: block egress from the host/container running the API to 169.254.169.254 and RFC1918 address ranges, enforce IMDSv2 with a hop limit of 1 on any cloud instance running the service, and place the API behind a proxy that performs its own strict SSRF filtering with redirect-following disabled. If the multimodal media-URL ingestion feature is not required, disable it entirely. For detection, alert on outbound requests from the LLaMA-Factory process to link-local or internal-only IP ranges and on unexpected redirect chains in application logs.

What systems are affected by CVE-2026-85673?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, agent frameworks.

What is the CVSS score for CVE-2026-85673?

CVE-2026-85673 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.51%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM-SSRF

What are the technical details?

Original Advisory

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.

Exploitation Scenario

An unauthenticated attacker sends a chat completion request to the exposed OpenAI-compatible API with a multimodal message referencing a media URL hosted on an attacker-controlled server with a public IP, which passes the initial check_ssrf_url validation. When LLaMA-Factory's backend issues the actual requests.get call, the attacker's server responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (or an internal admin endpoint); since the redirect target is never re-validated, the SSRF guard is silently bypassed. Alternatively, the attacker uses DNS rebinding — resolving the media URL's domain to a public IP at validation time and to an internal IP at connection time — achieving the same effect without needing a redirect. Depending on how the fetched content is processed (treated as image bytes, echoed in error messages, or surfaced through model output), the attacker can exfiltrate cloud IAM credentials or internal service responses.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.