CVE-2026-85686: MS Swift unauth SSRF

CISO Take

ms-swift's OpenAI-compatible deployment API fetches image, audio, and video URLs supplied by callers without any validation or redirect filtering, letting an unauthenticated attacker force the server to make arbitrary outbound requests to internal services or cloud metadata endpoints (169.254.169.254). CVSS 7.5 reflects a network-exploitable, low-complexity, no-auth confidentiality-only flaw with a public GitHub issue and a VulnCheck advisory already available, though no PoC or Nuclei template exists yet and it is not in CISA KEV, so opportunistic scanning risk is currently moderate rather than imminent. The real exposure is architectural: any team that exposed ms-swift's deploy endpoint for multimodal inference (a common pattern for self-hosted vision/audio LLM serving) has effectively handed attackers a pivot into cloud IAM credentials and internal network reconnaissance, with zero authentication required. Patch to a fixed ms-swift release once available, and in the meantime block the deploy API from reaching cloud metadata IPs and internal CIDRs via network policy or an egress proxy allowlist, and require authentication in front of the OpenAI-compatible endpoint. Detection teams should watch for outbound requests from the ms-swift host to 169.254.169.254 or unexpected internal IPs in the image_url/audio_url/video_url parameters.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High exploitability (network, low complexity, no auth, no user interaction — CVSS 7.5, AV:N/AC:L/PR:N/UI:N) combined with severe potential impact (cloud metadata credential theft, internal service enumeration) despite the CVSS impact score only reflecting confidentiality (C:H). No EPSS data, no CISA KEV listing, no public exploit or Nuclei template exist yet, so active mass exploitation is unconfirmed — but SSRF-to-metadata-endpoint is a well-understood, trivially weaponizable primitive once the vulnerable parameter is known, and the vendor advisory plus GitHub issue give attackers a clear roadmap. Any internet-facing ms-swift deployment with the multimodal deploy API enabled should be treated as high risk until patched or network-isolated.

How does the attack unfold?

Discovery

Attacker fingerprints an internet-facing ms-swift OpenAI-compatible deploy endpoint serving multimodal models.

AML.T0006

Exploitation

Attacker submits a request with image_url/audio_url/video_url pointing to an internal service or cloud metadata IP, triggering an unvalidated server-side fetch.

AML.T0049

Credential/Data Exposure

The server-side fetch returns internal data or cloud IAM credentials from the metadata endpoint, which leaks back to the attacker via the response or error output.

AML.T0040

Impact

Attacker uses harvested cloud credentials or internal network access to pivot further into the victim's infrastructure.

Discovery

Attacker fingerprints an internet-facing ms-swift OpenAI-compatible deploy endpoint serving multimodal models.

AML.T0006

Exploitation

Attacker submits a request with image_url/audio_url/video_url pointing to an internal service or cloud metadata IP, triggering an unvalidated server-side fetch.

AML.T0049

Credential/Data Exposure

The server-side fetch returns internal data or cloud IAM credentials from the metadata endpoint, which leaks back to the attacker via the response or error output.

AML.T0040

Impact

Attacker uses harvested cloud credentials or internal network access to pivot further into the victim's infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MS Swift	pip	—	No patch
16.0K6 dependentsPushed yesterday20% patched~84d to patchFull package profile →

Do you use MS Swift? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade ms-swift beyond 4.5.2 as soon as a fix is released (track the GitHub issue https://github.com/modelscope/ms-swift/issues/9740 and the repo for a patched version). 2) Until patched, do not expose the swift deploy OpenAI-compatible API directly to untrusted networks; place it behind authentication and a reverse proxy. 3) Block outbound access from the ms-swift host to cloud metadata endpoints (169.254.169.254, metadata.google.internal) via firewall/iptables rules or an egress proxy allowlist, and disable IMDSv1 in favor of IMDSv2/token-based metadata access where the cloud provider supports it. 4) Implement URL validation on the server side rejecting private/link-local/reserved IP ranges and disallowing redirects for image_url/audio_url/video_url parameters (defense-in-depth even after patching). 5) Monitor egress logs from inference hosts for connections to metadata IPs or unexpected internal addresses.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageInferenceAPIAML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4-AI system operation and monitoring

NIST AI RMF

MAP 5.1 / MANAGE 4.1-Risks from third-party AI system components are mapped and managed

OWASP LLM Top 10

LLM03-Supply Chain Vulnerabilities / Insecure Plugin Design (SSRF in tool/URL fetching)

Frequently Asked Questions

What is CVE-2026-85686?

ms-swift's OpenAI-compatible deployment API fetches image, audio, and video URLs supplied by callers without any validation or redirect filtering, letting an unauthenticated attacker force the server to make arbitrary outbound requests to internal services or cloud metadata endpoints (169.254.169.254). CVSS 7.5 reflects a network-exploitable, low-complexity, no-auth confidentiality-only flaw with a public GitHub issue and a VulnCheck advisory already available, though no PoC or Nuclei template exists yet and it is not in CISA KEV, so opportunistic scanning risk is currently moderate rather than imminent. The real exposure is architectural: any team that exposed ms-swift's deploy endpoint for multimodal inference (a common pattern for self-hosted vision/audio LLM serving) has effectively handed attackers a pivot into cloud IAM credentials and internal network reconnaissance, with zero authentication required. Patch to a fixed ms-swift release once available, and in the meantime block the deploy API from reaching cloud metadata IPs and internal CIDRs via network policy or an egress proxy allowlist, and require authentication in front of the OpenAI-compatible endpoint. Detection teams should watch for outbound requests from the ms-swift host to 169.254.169.254 or unexpected internal IPs in the image_url/audio_url/video_url parameters.

Is CVE-2026-85686 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-85686, increasing the risk of exploitation.

How to fix CVE-2026-85686?

1) Upgrade ms-swift beyond 4.5.2 as soon as a fix is released (track the GitHub issue https://github.com/modelscope/ms-swift/issues/9740 and the repo for a patched version). 2) Until patched, do not expose the `swift deploy` OpenAI-compatible API directly to untrusted networks; place it behind authentication and a reverse proxy. 3) Block outbound access from the ms-swift host to cloud metadata endpoints (169.254.169.254, metadata.google.internal) via firewall/iptables rules or an egress proxy allowlist, and disable IMDSv1 in favor of IMDSv2/token-based metadata access where the cloud provider supports it. 4) Implement URL validation on the server side rejecting private/link-local/reserved IP ranges and disallowing redirects for image_url/audio_url/video_url parameters (defense-in-depth even after patching). 5) Monitor egress logs from inference hosts for connections to metadata IPs or unexpected internal addresses.

What systems are affected by CVE-2026-85686?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM API deployment, multimodal inference pipelines.

What is the CVSS score for CVE-2026-85686?

CVE-2026-85686 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

model servingLLM API deploymentmultimodal inference pipelines

MITRE ATLAS Techniques

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.4

NIST AI RMF: MAP 5.1 / MANAGE 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.

Exploitation Scenario

An attacker discovers an internet-facing ms-swift multimodal inference endpoint (e.g., via Shodan/censys fingerprinting of the OpenAI-compatible API path) and sends a chat completion request with `image_url` set to `http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>`. The server, acting as an unwitting proxy, fetches this URL server-side to retrieve the 'image' and returns the response content (or an error revealing it) back through the model's processing pipeline or error message, leaking cloud IAM temporary credentials. The attacker then uses those credentials to pivot into the victim's cloud account, escalating from a single misconfigured inference endpoint to broader cloud infrastructure compromise — no authentication or user interaction required at any step.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.