CVE-2026-2654: Huggingface Smolagents SSRF Vulnerability

CVE-2026-2654 is a server-side request forgery flaw in Huggingface Smolagents 1.24.0 affecting the LocalPythonExecutor component. Attackers can exploit this remotely to manipulate server requests. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-2654 Overview

CVE-2026-2654 is a Server-Side Request Forgery (SSRF) vulnerability affecting Hugging Face smolagents version 1.24.0. The flaw resides in the LocalPythonExecutor component, where calls to requests.get and requests.post accept attacker-influenced URLs without adequate validation. An authenticated remote attacker can manipulate these requests to reach internal services or unintended destinations. A public proof-of-concept exists in a third-party GitHub repository. The vendor was contacted prior to disclosure but did not respond. The vulnerability is categorized under CWE-918.

Critical Impact
Attackers with low-privilege access can coerce the agent runtime to issue HTTP requests to arbitrary internal or external endpoints, enabling reconnaissance and pivoting against internal infrastructure.

Affected Products

Hugging Face smolagents 1.24.0
LocalPythonExecutor component invoking requests.get / requests.post
Deployments exposing smolagents-based agent endpoints over the network

Discovery Timeline

2026-02-18 - CVE-2026-2654 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2654

Vulnerability Analysis

The smolagents framework provides agentic LLM tooling that executes Python code through a LocalPythonExecutor. Within this executor, the requests.get and requests.post functions can be invoked with URLs derived from user or model-controlled input. Because the executor does not restrict destination hosts, attackers can direct outbound requests to internal IP ranges, cloud metadata endpoints, or other non-public services. The result is a classic SSRF condition in which the server acts as a confused deputy on behalf of the attacker.

The vulnerability is reachable remotely and requires only low privileges. A working exploit has been published to a public GitHub repository, lowering the barrier for opportunistic abuse.

Root Cause

The root cause is missing destination validation in the LocalPythonExecutor request flow. Neither the executor nor the surrounding agent framework enforces an allow-list of hosts, blocks loopback and link-local addresses, or filters cloud metadata endpoints such as 169.254.169.254 before issuing HTTP requests through the requests library.

Attack Vector

An attacker interacts with a smolagents-powered agent that exposes the executor over the network. By submitting crafted prompts or tool inputs, the attacker causes the agent to construct and execute a requests.get or requests.post call targeting an internal resource. The server then returns response data, headers, or timing signals that the attacker can use to enumerate internal services, exfiltrate cloud instance credentials, or interact with otherwise unreachable HTTP APIs.

For a working demonstration, refer to the GitHub PoC Repository.

Detection Methods for CVE-2026-2654

Indicators of Compromise

Outbound HTTP requests from smolagents host processes to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
Unexpected requests library traffic originating from Python processes hosting LocalPythonExecutor.
Agent prompt or tool inputs containing URLs that reference internal hostnames, cloud metadata services, or non-standard ports.

Detection Strategies

Inspect agent and application logs for requests.get and requests.post calls with attacker-influenced URL parameters.
Correlate prompt content with subsequent outbound network connections from the smolagents runtime.
Alert on egress traffic from agent workloads to destinations not on an approved allow-list.

Monitoring Recommendations

Forward smolagents application logs and host network telemetry into a centralized analytics platform for correlation.
Monitor cloud metadata endpoints for access originating from agent compute instances.
Track version inventory to identify any deployment running smolagents 1.24.0.

How to Mitigate CVE-2026-2654

Immediate Actions Required

Inventory all systems running Hugging Face smolagents 1.24.0 and isolate them from sensitive internal networks.
Restrict egress from agent hosts to a minimal allow-list, explicitly blocking cloud metadata IPs and RFC1918 ranges where not required.
Disable or sandbox the LocalPythonExecutor until a vendor-supplied fix is available.

Patch Information

No vendor patch or advisory is referenced in the available CVE data. The vendor did not respond to the disclosure. Track the VulDB entry #346451 and the Hugging Face smolagents project repository for future fixes.

Workarounds

Wrap or monkey-patch requests.get and requests.post in the executor to enforce host allow-listing and reject internal address ranges.
Run the agent runtime inside a network namespace or container with egress filtering applied at the gateway.
Require IMDSv2 on AWS and equivalent metadata protections on other clouds to limit credential exposure from SSRF.

bash

# Example egress restriction blocking metadata and loopback from the agent host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT