CVE-2026-4308: Agent-Zero 0.9.7 SSRF Vulnerability

CVE-2026-4308 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in frdel/agent0ai agent-zero version 0.9.7. This weakness affects the handle_pdf_document function within the file python/helpers/document_query.py. Through manipulation of this function, attackers can forge server-side requests to internal or external resources, potentially accessing sensitive data or pivoting to internal network assets. The attack can be executed remotely by authenticated users with low privileges, and a public proof-of-concept exploit is available.

Critical Impact

Remote attackers can leverage this SSRF vulnerability to access internal services, exfiltrate sensitive data, or pivot within internal networks by abusing the PDF document handling functionality.

Affected Products

• frdel/agent0ai agent-zero 0.9.7

Discovery Timeline

• 2026-03-17 - CVE CVE-2026-4308 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-4308

Vulnerability Analysis

This SSRF vulnerability (CWE-918) exists in the PDF document handling functionality of the agent-zero AI assistant framework. The handle_pdf_document function in python/helpers/document_query.py fails to properly validate and sanitize URLs or file paths provided by users when processing PDF documents. This allows attackers to craft malicious requests that force the server to make requests to arbitrary destinations, including internal network resources that would otherwise be inaccessible from the external network.

The vulnerability requires only low-privilege authentication to exploit, and the attack complexity is low due to the straightforward nature of SSRF exploitation through document URL parameters. While confidentiality, integrity, and availability impacts are limited in scope, successful exploitation could allow attackers to probe internal infrastructure, access cloud metadata services, or interact with other internal services.

Root Cause

The root cause is improper input validation in the handle_pdf_document function. The function processes user-supplied URLs or file references when handling PDF documents without adequately validating that the target resource is an authorized external destination. This lack of URL validation allows attackers to specify internal IP addresses, localhost references, or cloud metadata endpoints that the server will then access on behalf of the attacker.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker can submit a crafted request to the document query functionality with a malicious URL pointing to internal resources. When the handle_pdf_document function processes this request, it initiates a server-side request to the attacker-specified destination, effectively bypassing network security controls that would otherwise prevent direct external access to those resources.

The attack flow involves:

1. Attacker authenticates to the agent-zero application
2. Attacker submits a document query request with a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata)
3. The server's handle_pdf_document function fetches the specified URL
4. The response from the internal resource is returned to the attacker or influences application behavior

Technical details and proof-of-concept information are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-4308

Indicators of Compromise

• Outbound requests from the application server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) or localhost (127.0.0.1)
• Requests to cloud metadata endpoints such as 169.254.169.254 originating from the agent-zero application
• Unusual PDF document query requests containing URL parameters pointing to internal services
• Log entries in document_query.py showing attempts to access non-standard or internal URLs

Detection Strategies

• Monitor application logs for requests to the document query endpoint with suspicious URL patterns
• Implement network-level detection for outbound connections from the application server to RFC1918 private address ranges
• Deploy web application firewall (WAF) rules to detect SSRF patterns in request parameters
• Use SentinelOne Singularity XDR to correlate network anomalies with application-level events

Monitoring Recommendations

• Enable verbose logging for the python/helpers/document_query.py module to capture all URL requests
• Configure alerts for any outbound connections from the agent-zero server to metadata services or internal networks
• Implement egress filtering monitoring to detect unexpected outbound HTTP/HTTPS requests
• Review application access logs regularly for patterns indicative of SSRF probing

How to Mitigate CVE-2026-4308

Immediate Actions Required

• Restrict network egress from the agent-zero application server to only required external destinations
• Implement URL allowlisting for the document query functionality, permitting only known-safe external domains
• Block outbound requests to private IP ranges and cloud metadata endpoints at the network level
• Consider disabling the PDF document URL fetching feature until a patch is available

Patch Information

No official patch is currently available from the vendor. According to the vulnerability disclosure, the vendor was contacted early about this issue but did not respond. Organizations should monitor the VulDB entry and the official agent-zero repository for security updates.

Workarounds

• Implement a server-side URL validation function that blocks requests to private IP addresses, localhost, and cloud metadata endpoints
• Deploy a proxy server for all outbound document fetching requests with strict URL filtering
• Use network segmentation to isolate the agent-zero application from sensitive internal resources
• Limit user access to the document query functionality to trusted administrators only

# Example iptables rules to block SSRF to internal networks
# Block access to private IP ranges from the application server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254/32 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP