CVE-2026-2654: Huggingface Smolagents SSRF Vulnerability

CVE-2026-2654 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in HuggingFace SmolAgents version 1.24.0. The vulnerability affects the requests.get and requests.post functions within the LocalPythonExecutor component. Remote attackers can manipulate requests to perform unauthorized server-side requests, potentially accessing internal services, exfiltrating data, or pivoting to other network resources. The exploit has been made publicly available, increasing the risk of active exploitation in the wild.

Critical Impact

Remote attackers can exploit this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal services, cloud metadata endpoints, or other protected resources not directly accessible from external networks.

Affected Products

• HuggingFace SmolAgents 1.24.0
• Applications using LocalPythonExecutor component with requests.get/requests.post functions
• Systems running SmolAgents without proper network segmentation

Discovery Timeline

• 2026-02-18 - CVE CVE-2026-2654 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2654

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The SSRF weakness exists within the LocalPythonExecutor component of HuggingFace SmolAgents, specifically in how the requests.get and requests.post functions handle user-controlled input.

When the LocalPythonExecutor processes agent commands that involve HTTP requests, it fails to properly validate and restrict the destination URLs. This allows an attacker to craft malicious inputs that force the server to make requests to arbitrary endpoints, including internal network resources, cloud provider metadata services (such as http://169.254.169.254/), or other sensitive infrastructure.

The vulnerability can be exploited remotely, requiring only low privileges to initiate the attack. According to public disclosure reports, the vendor was contacted about this vulnerability but did not respond, leaving users without an official patch.

Root Cause

The root cause lies in insufficient input validation and URL sanitization within the LocalPythonExecutor component. The requests.get and requests.post functions do not implement proper allowlisting or blocklisting mechanisms to restrict which hosts and ports can be accessed. This design flaw allows attacker-controlled URLs to be passed directly to the HTTP request functions, enabling arbitrary server-side requests.

Attack Vector

The attack can be launched remotely over the network. An attacker with low-level access to the SmolAgents system can manipulate the target URL parameters processed by LocalPythonExecutor. By injecting malicious URLs pointing to internal services, metadata endpoints, or other sensitive targets, the attacker can leverage the server's network position to access resources that would otherwise be unreachable from external networks.

The vulnerability mechanism involves the following exploitation path: the attacker supplies a crafted URL through agent input that is processed by LocalPythonExecutor. When the executor calls requests.get or requests.post with the attacker-controlled URL, the server performs the HTTP request on behalf of the attacker, potentially returning sensitive data or triggering actions on internal systems. For technical details and proof-of-concept information, see the GitHub PoC Report.

Detection Methods for CVE-2026-2654

Indicators of Compromise

• Unusual outbound HTTP requests from SmolAgents server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests targeting cloud metadata endpoints such as http://169.254.169.254/ or http://metadata.google.internal/
• Anomalous request patterns in LocalPythonExecutor logs showing external URLs being processed
• Network traffic to internal services that should not be accessible from the SmolAgents application

Detection Strategies

• Implement network monitoring to detect HTTP requests from SmolAgents servers to internal network ranges or cloud metadata endpoints
• Deploy web application firewalls (WAF) with SSRF detection rules to identify and block malicious URL patterns
• Enable detailed logging for all requests.get and requests.post operations within the LocalPythonExecutor component
• Configure SentinelOne Singularity to monitor for suspicious network behavior from Python-based AI agent applications

Monitoring Recommendations

• Set up alerts for outbound connections from SmolAgents servers to RFC 1918 private IP addresses
• Monitor DNS queries from SmolAgents infrastructure for internal hostname resolution attempts
• Implement egress filtering logs and analyze traffic patterns for anomalous destinations
• Review application logs for error messages indicating failed internal service connections

How to Mitigate CVE-2026-2654

Immediate Actions Required

• Restrict network access from SmolAgents servers to only necessary external endpoints using firewall rules
• Implement egress filtering to block access to internal IP ranges and cloud metadata endpoints from the application layer
• Consider temporarily disabling or isolating the LocalPythonExecutor component if not critical to operations
• Review and audit all URLs processed by the affected functions for signs of exploitation

Patch Information

At the time of publication, no official patch is available from the vendor. According to the vulnerability disclosure, the vendor was contacted but did not respond. Users should monitor the HuggingFace SmolAgents repository and official channels for security updates. Additional technical details are available via VulDB #346451.

Workarounds

• Implement a URL allowlist at the application level to restrict LocalPythonExecutor to approved external domains only
• Deploy a forward proxy that validates and filters all outbound HTTP requests from SmolAgents
• Use network segmentation to isolate SmolAgents servers from sensitive internal resources
• Apply cloud provider metadata endpoint blocking (e.g., AWS IMDSv2 enforcement) to prevent credential theft

# Example: Block access to common SSRF targets using iptables
# Block cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 169.254.169.253 -j DROP

# Block common internal ranges from SmolAgents server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Note: Adjust rules based on your environment's legitimate internal access needs