CVE-2026-54690: datamodel-code-generator SSRF Vulnerability

CVE-2026-54690 Overview

CVE-2026-54690 is a Server-Side Request Forgery (SSRF) vulnerability in datamodel-code-generator, a Python tool that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from schema formats including OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Versions from 0.9.1 up to 0.61.0 silently dereference attacker-controlled JSON Schema $ref HTTP or HTTPS URLs. The --allow-remote-refs gate warns instead of blocking, enabling SSRF against internal services. The issue is fixed in version 0.61.0.

Critical Impact
An attacker who supplies a malicious schema can force the generator to issue HTTP or HTTPS requests to internal endpoints, reaching cloud metadata services, private networks, and other services otherwise unreachable from outside the host.

Affected Products

datamodel-code-generator versions 0.9.1 through 0.60.x
Python projects and CI pipelines invoking the generator against untrusted schemas
Automated toolchains that convert third-party OpenAPI or JSON Schema documents to code

Discovery Timeline

2026-07-28 - CVE-2026-54690 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54690

Vulnerability Analysis

The vulnerability, classified under CWE-918, stems from unsafe resolution of remote schema references. When the parser encounters a JSON Schema $ref containing an HTTP or HTTPS URL, _get_ref_body in src/datamodel_code_generator/parser/jsonschema.py invokes the HTTP client in src/datamodel_code_generator/http.py to retrieve the referenced document. The tool then integrates the fetched content into code generation.

The --allow-remote-refs control was intended to gate this behavior but only emitted a warning rather than blocking the request. As a result, remote reference resolution occurred silently even when operators expected it to be disabled. Because the HTTP client did not restrict destinations to public networks, requests could target loopback, link-local, RFC1918, and cloud metadata endpoints such as 169.254.169.254.

Root Cause

Two root causes combine to produce the flaw. First, _get_ref_body dereferences attacker-supplied URLs without validating them against an allowlist. Second, the --allow-remote-refs gate is advisory rather than enforcing, so remote fetches proceed with a warning. The absence of a private-network filter allows the resulting requests to reach internal services.

Attack Vector

An attacker publishes or submits a JSON Schema, OpenAPI document, or similar input containing a $ref pointing to an internal URL. When a developer or CI job runs datamodel-codegen against that schema, the generator issues an outbound HTTP request from the build host to the attacker-selected target. This can enumerate internal services, retrieve cloud instance metadata, or trigger side effects on internal APIs that trust source-network position.

python

// Patch adding allow_private_network flag - src/datamodel_code_generator/__init__.py
                    config.http_ignore_tls,
                    config.http_query_parameters,
                    timeout,
+                    allow_private_network=config.allow_private_network,
                ),
            )
        case _:

python

// Patch adding config option - src/datamodel_code_generator/__main__.py
    allof_merge_mode: AllOfMergeMode = AllOfMergeMode.Constraints
    allof_class_hierarchy: AllOfClassHierarchy = AllOfClassHierarchy.IfNoConflict
    allow_remote_refs: Optional[bool] = None  # noqa: UP045
+    allow_private_network: bool = False
    http_headers: Optional[Sequence[tuple[str, str]]] = None  # noqa: UP045
    http_local_ref_path: Optional[Path] = None  # noqa: UP045
    http_ignore_tls: bool = False

Source: GitHub commit 5fdba4a0

Detection Methods for CVE-2026-54690

Indicators of Compromise

Outbound HTTP or HTTPS requests from developer workstations or CI runners to internal addresses immediately after datamodel-codegen execution.
Requests originating from build hosts to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Log entries in datamodel-code-generator invocations that warn about remote references while proceeding to fetch them.

Detection Strategies

Inspect CI/CD pipeline network egress for connections initiated by Python processes running datamodel-codegen.
Audit source repositories and vendored schemas for $ref values containing HTTP or HTTPS URLs pointing to non-public hosts.
Correlate process telemetry showing datamodel-codegen execution with subsequent outbound HTTP requests to unexpected destinations.

Monitoring Recommendations

Enable egress filtering on build infrastructure and alert on connections from build hosts to RFC1918, loopback, or metadata address ranges.
Track installed versions of datamodel-code-generator in dependency manifests and flag any release earlier than 0.61.0.
Log all invocations of code-generation tooling with full argument lists to support post-incident review.

How to Mitigate CVE-2026-54690

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.61.0 or later across all developer environments and CI systems.
Audit schemas and OpenAPI documents already processed by vulnerable versions for suspicious $ref URLs.
Restrict network egress from CI runners to only the destinations required for builds.

Patch Information

The fix is available in datamodel-code-generator 0.61.0. The patch introduces an allow_private_network configuration option that defaults to False, ensuring the HTTP client refuses to connect to private-network destinations unless explicitly enabled. See the GHSA-954p-556p-r752 advisory for full details.

Workarounds

Run datamodel-codegen only against schemas from trusted sources until upgrading.
Execute the generator inside a network-isolated sandbox that blocks access to internal address ranges and cloud metadata services.
Pre-process input schemas to strip any $ref fields containing HTTP or HTTPS URLs before invoking the generator.

bash

# Upgrade to the patched release
pip install --upgrade 'datamodel-code-generator>=0.61.0'

# Verify installed version
datamodel-codegen --version