CVE-2026-18973 Overview
CVE-2026-18973 is a server-side request forgery (SSRF) vulnerability affecting heshengtao super-agent-party up to version 0.4.1. The flaw resides in the sanitize_proxy_url function within server.py, part of the extension_proxy Route component. Attackers can manipulate the url argument to coerce the server into issuing arbitrary outbound requests. Exploitation is possible remotely without authentication or user interaction. A public exploit has been disclosed, and the vendor did not respond to early disclosure attempts, leaving affected deployments exposed.
Critical Impact
Unauthenticated remote attackers can abuse the extension_proxy route to force the server to make arbitrary HTTP requests, potentially reaching internal services, metadata endpoints, or other restricted network resources.
Affected Products
- heshengtao super-agent-party versions up to and including 0.4.1
- Component: extension_proxy Route in server.py
- Vulnerable function: sanitize_proxy_url
Discovery Timeline
- 2026-08-06 - CVE-2026-18973 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18973
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery (SSRF) issue classified under [CWE-918]. The sanitize_proxy_url function in server.py is intended to validate URLs passed to the extension_proxy Route. Insufficient validation of the url parameter allows attackers to supply crafted URLs that bypass sanitization. The application then issues server-side requests to attacker-chosen destinations.
Because the flaw is reachable over the network without authentication, attackers can invoke the vulnerable route directly from the internet when the service is exposed. SSRF in an agent-oriented service is particularly relevant because such services frequently run in environments that host cloud metadata endpoints, internal APIs, or trusted intranet resources. The public disclosure of a proof of concept increases the likelihood of opportunistic exploitation.
Root Cause
The root cause is improper input validation inside sanitize_proxy_url. The sanitizer fails to enforce a strict allowlist of destinations, protocols, or address ranges. As a result, user-supplied URLs referencing internal IP addresses, loopback interfaces, or alternative schemes are accepted and dereferenced by the server.
Attack Vector
An unauthenticated attacker sends an HTTP request to the extension_proxy route with a malicious url argument. The server processes the URL through sanitize_proxy_url, which fails to reject internal or non-permitted targets. The server then issues an outbound request to the attacker-controlled destination and may return the response to the caller. This behavior enables reconnaissance of internal networks, access to cloud instance metadata services, and interaction with internal HTTP APIs.
No verified exploit code is republished here. Technical details are available in the GitHub Gist PoC Repository and the VulDB CVE-2026-18973 entry.
Detection Methods for CVE-2026-18973
Indicators of Compromise
- Inbound HTTP requests to the extension_proxy route containing url parameters that reference internal IP ranges such as 127.0.0.1, 169.254.169.254, or RFC1918 addresses.
- Outbound connections from the super-agent-party host to cloud metadata endpoints or unexpected internal services.
- Unusual protocol schemes in url arguments, including file://, gopher://, or dict://.
Detection Strategies
- Inspect application logs for requests to extension_proxy and correlate the url parameter with the destinations subsequently contacted by the process.
- Deploy egress filtering rules that flag or block connections from the super-agent-party host to internal-only address ranges.
- Add web application firewall signatures that reject requests to the vulnerable route when url parameters point to private or link-local addresses.
Monitoring Recommendations
- Monitor process-level network telemetry from the Python server.py process for anomalous outbound HTTP traffic patterns.
- Alert on any access to cloud metadata IPs (169.254.169.254) originating from the affected workload.
- Track authentication-free access patterns to extension_proxy and baseline normal usage against spikes that may indicate probing.
How to Mitigate CVE-2026-18973
Immediate Actions Required
- Restrict network exposure of super-agent-party instances so that the extension_proxy route is not reachable from untrusted networks.
- Apply strict egress firewall rules to block outbound requests from the service to internal address ranges and cloud metadata endpoints.
- Review recent access logs for suspicious requests to extension_proxy and evidence of SSRF probing.
Patch Information
At the time of publication, the vendor did not respond to disclosure and no official patch is referenced in the NVD entry. Monitor the upstream heshengtao super-agent-party project for updates beyond version 0.4.1. Track the VulDB Vulnerability #386262 entry for status changes.
Workarounds
- Place the service behind an authenticated reverse proxy and deny anonymous access to the extension_proxy route.
- Implement a network-level allowlist that permits the process to reach only required external endpoints.
- If feasible, disable the extension_proxy functionality until a validated fix is available.
# Example egress restriction using iptables to block SSRF-relevant destinations
# Block loopback and link-local from the service user (adjust UID as needed)
iptables -A OUTPUT -m owner --uid-owner super-agent -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner super-agent -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner super-agent -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner super-agent -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner super-agent -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
