CVE-2026-34526: SillyTavern SSRF Vulnerability

CVE-2026-34526 Overview

CVE-2026-34526 is a Server-Side Request Forgery (SSRF) vulnerability in SillyTavern, a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. The vulnerability exists in src/endpoints/search.js where the hostname validation regex only matches literal dotted-quad IPv4 addresses, failing to properly block other formats that resolve to internal addresses.

Critical Impact

Attackers with low privileges can potentially access internal network services on default ports (80/443) by bypassing the incomplete hostname validation, enabling reconnaissance of internal infrastructure.

Affected Products

• SillyTavern versions prior to 1.17.0

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-34526 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34526

Vulnerability Analysis

The vulnerability stems from insufficient input validation in the search endpoint of SillyTavern. The application implements a hostname check using the regex pattern /^\d+\.\d+\.\d+\.\d+$/ to prevent access to internal IP addresses. However, this validation approach is fundamentally flawed as it only blocks literal dotted-quad IPv4 addresses like 127.0.0.1 or 10.0.0.1.

The regex validation can be bypassed through multiple attack vectors including: the localhost hostname (which is not in dotted-quad format), IPv6 loopback notation [::1], and DNS names that resolve to internal addresses (such as localtest.me which resolves to 127.0.0.1). While the vulnerability scope is constrained by a separate port validation check that requires default ports (80/443), attackers can still leverage this SSRF to probe and interact with internal services listening on these common ports.

Root Cause

The root cause is the use of an overly simplistic regex pattern for hostname validation that only considers one specific format of internal IP addresses. The validation fails to account for the multiple ways internal network resources can be addressed, including hostnames, IPv6 notation, and DNS rebinding techniques. This represents a classic case of incomplete blocklist validation (CWE-918: Server-Side Request Forgery).

Attack Vector

The attack vector is network-based and requires low privileges to exploit. An authenticated attacker can craft requests to the vulnerable search endpoint using hostname formats that bypass the IPv4 regex check while still resolving to internal network addresses. The changed scope allows the attacker to interact with internal services that would otherwise be inaccessible from external networks, potentially exposing sensitive internal resources or enabling further lateral movement within the network.

The vulnerability can be exploited by submitting requests with hostnames such as localhost, [::1], or DNS names like localtest.me that resolve to internal addresses. These bypass the dotted-quad validation while still accessing the local loopback interface or internal network. For detailed technical information on the exploitation techniques, refer to the GitHub Security Advisory GHSA-wm7j-m6jm-8797.

Detection Methods for CVE-2026-34526

Indicators of Compromise

• Unusual outbound requests from the SillyTavern server to internal IP ranges or localhost variants
• Requests containing localhost, [::1], or known DNS rebinding domains (e.g., localtest.me, spoofed.burpcollaborator.net) in URL parameters
• Unexpected access patterns to internal services on ports 80 or 443 originating from the SillyTavern application
• Log entries showing failed or successful connections to internal infrastructure from the search endpoint

Detection Strategies

• Implement network monitoring to detect outbound connections from the SillyTavern server to internal IP ranges and loopback addresses
• Create alerting rules for HTTP requests containing known SSRF bypass patterns such as IPv6 loopback, localhost hostnames, or DNS rebinding domains
• Deploy web application firewall (WAF) rules to inspect and block requests with suspicious URL parameters targeting internal resources

Monitoring Recommendations

• Enable verbose logging for the SillyTavern application, particularly for the search endpoint
• Monitor DNS resolution logs for queries to known rebinding domains originating from the application server
• Implement egress traffic analysis to identify connections to internal network segments from the application host
• Review access logs for patterns of requests attempting to enumerate internal services

How to Mitigate CVE-2026-34526

Immediate Actions Required

• Upgrade SillyTavern to version 1.17.0 or later immediately
• Review application logs for signs of SSRF exploitation attempts
• Implement network-level controls to restrict outbound connections from the SillyTavern server
• Consider deploying a reverse proxy with URL validation capabilities as an additional defense layer

Patch Information

The vulnerability has been addressed in SillyTavern version 1.17.0. Users should upgrade to this version or later to receive the security fix. The patch improves the hostname validation to properly block all forms of internal address references. Release information is available at the SillyTavern Release v1.17.0 page.

Workarounds

• Deploy a network-level firewall rule to restrict the SillyTavern server from initiating outbound connections to internal IP ranges including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16
• Configure DNS-level blocking for known rebinding domains such as localtest.me and similar services
• Use a reverse proxy to validate and sanitize URLs before they reach the SillyTavern application
• Limit network access for the SillyTavern deployment to only necessary external resources via allowlist-based egress filtering

# Example iptables rules to block SSRF to internal networks
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner sillytavern -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner sillytavern -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner sillytavern -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner sillytavern -j DROP