CVE-2026-10177: Aider-AI Aider SSRF Vulnerability

CVE-2026-10177 Overview

CVE-2026-10177 is a Server-Side Request Forgery (SSRF) vulnerability in Aider-AI Aider version 0.86.3. The flaw resides in the requests.get call within the api_docs.py file, which interacts with the AWS EC2 Metadata Endpoint component. An attacker can manipulate the request to force the application to issue HTTP requests to attacker-influenced destinations. The vulnerability is remotely exploitable and has been publicly disclosed. A pull request to fix this issue is pending acceptance upstream. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Remote attackers with low privileges can coerce Aider to query internal endpoints such as the AWS EC2 Instance Metadata Service, potentially exposing cloud instance metadata and IAM credentials.

Affected Products

Aider-AI Aider 0.86.3
Component: api_docs.py (requests.get function)
Interaction with AWS EC2 Metadata Endpoint

Discovery Timeline

2026-05-31 - CVE-2026-10177 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10177

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) issue within the Aider command-line AI coding assistant. The affected code path lives in api_docs.py, where the requests.get function fetches remote documentation without sufficient validation of the supplied URL. Because the destination is influenced by user-controllable input, an attacker can redirect outbound requests to internal network resources, including cloud metadata services. On AWS, the EC2 Instance Metadata Service (IMDS) is a common SSRF target because it can return temporary IAM credentials when accessed from within an EC2 instance.

Root Cause

The root cause is the absence of URL validation and network egress restriction in the requests.get invocation inside api_docs.py. The function trusts attacker-controllable input and does not enforce an allow-list of permitted hosts. There is no filter preventing requests to link-local addresses such as 169.254.169.254, which serves AWS metadata.

Attack Vector

An attacker with low privileges and network access supplies a URL that points to an internal or metadata endpoint. When Aider processes the documentation fetch, the server-side process issues the request and returns or exposes data accessible only from the host context. On cloud-hosted deployments, this can include IMDS responses that disclose instance identity and IAM role credentials. No user interaction is required beyond triggering the vulnerable code path.

No verified proof-of-concept code is published. See the GitHub Aider Issue #5075 and Pull Request #5137 for upstream discussion and the proposed fix.

Detection Methods for CVE-2026-10177

Indicators of Compromise

Outbound HTTP requests from Aider host processes to 169.254.169.254 or other link-local addresses.
Unexpected requests.get calls originating from api_docs.py to non-documentation hosts.
Access patterns in cloud audit logs indicating IMDS queries from processes hosting Aider.

Detection Strategies

Monitor Python process network telemetry for connections to cloud metadata IP ranges from Aider workloads.
Inspect application logs for documentation fetch URLs that do not match the expected provider domains.
Correlate AWS CloudTrail AssumeRole and STS activity with the source instance running Aider to spot credential reuse.

Monitoring Recommendations

Enforce IMDSv2 on EC2 instances and alert on IMDSv1 fallback attempts.
Capture egress flow logs from hosts running Aider and alert on traffic to RFC1918 or link-local destinations not in the baseline.
Track new VulDB entries and GitHub activity on VulDB CVE-2026-10177 for updated exploit intelligence.

How to Mitigate CVE-2026-10177

Immediate Actions Required

Restrict Aider's network egress so it cannot reach 169.254.169.254 or other internal-only endpoints.
Require IMDSv2 with session tokens on all EC2 instances that host or interact with Aider.
Limit IAM role privileges attached to instances running Aider following least-privilege principles.
Audit Aider deployments for exposure and isolate the service from sensitive networks until patched.

Patch Information

No official released patch is available at publication time. The upstream fix is tracked in GitHub Pull Request #5137 and awaits acceptance. Monitor the Aider-AI repository for a tagged release that includes the fix and upgrade once available.

Workarounds

Apply egress filtering at the host or VPC level to block requests to cloud metadata addresses.
Run Aider in containers configured with --network policies that deny link-local traffic.
Validate or allow-list documentation URLs before processing by api_docs.py using a local patch derived from PR #5137.
Rotate any IAM credentials that may have been exposed via instance metadata.

bash

# Configuration example: block IMDS access at the host level for Aider workloads
sudo iptables -A OUTPUT -m owner --uid-owner aider -d 169.254.169.254 -j DROP

# Enforce IMDSv2 on an existing EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled