CVE-2026-54691: datamodel-code-generator SSRF Vulnerability

CVE-2026-54691 Overview

CVE-2026-54691 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in datamodel-code-generator, a Python tool that generates data models from schema definitions. Versions from 0.9.1 up to (but not including) 0.61.0 accept --url targets and follow redirect chains in src/datamodel_code_generator/http.py (http.get_body) without validating the destination host or IP address. Attackers can direct the tool to loopback interfaces, private network ranges, link-local addresses, cloud instance metadata endpoints, and other internal resources. The maintainer released a fix in version 0.61.0.

Critical Impact
An attacker who controls a supplied URL or a redirect target can coerce datamodel-code-generator into issuing requests to internal hosts and cloud metadata services, exposing sensitive infrastructure data.

Affected Products

datamodel-code-generator versions 0.9.1 through 0.60.x
Any Python project or CI pipeline invoking datamodel-code-generator with attacker-influenced --url inputs
Any environment where the tool follows HTTP redirects to reach schema definitions

Discovery Timeline

2026-07-28 - CVE-2026-54691 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54691

Vulnerability Analysis

The vulnerability resides in the HTTP client used by datamodel-code-generator to fetch remote schema definitions. The http.get_body function in src/datamodel_code_generator/http.py retrieves the resource specified by the --url argument and follows any HTTP redirects returned by the server. Neither the initial target nor subsequent redirect destinations undergo host or IP validation.

Because the tool is commonly executed in developer workstations, container build steps, and continuous integration runners, it frequently runs in environments with privileged network positioning. An attacker who can influence the URL passed to the tool, or who controls an intermediate server that issues a redirect, can pivot the request toward internal services that would otherwise be unreachable from outside the network.

Root Cause

The HTTP fetch path lacks an allowlist or deny policy for destination addresses. Requests to 127.0.0.1, RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.0.0/16 (including cloud metadata endpoints such as 169.254.169.254), and other non-routable ranges are handled identically to public destinations. The redirect handler inherits the same trust model, meaning a public URL can transparently become an internal one during redirection.

Attack Vector

Exploitation requires that a user or automated system be induced to pass a malicious URL to datamodel-code-generator, or that a legitimate remote schema server be attacker-controlled and issue a crafted redirect. The tool then issues an HTTP request from the host running it, potentially returning response content or side effects to the attacker via the schema-parsing output or through observable behavior.

python

# Security patch from src/datamodel_code_generator/__init__.py
                    config.http_ignore_tls,
                    config.http_query_parameters,
                    timeout,
+                   allow_private_network=config.allow_private_network,
                ),
            )
        case _:

# Security patch from src/datamodel_code_generator/__main__.py
    allof_merge_mode: AllOfMergeMode = AllOfMergeMode.Constraints
    allof_class_hierarchy: AllOfClassHierarchy = AllOfClassHierarchy.IfNoConflict
    allow_remote_refs: Optional[bool] = None  # noqa: UP045
+   allow_private_network: bool = False
    http_headers: Optional[Sequence[tuple[str, str]]] = None  # noqa: UP045
    http_local_ref_path: Optional[Path] = None  # noqa: UP045
    http_ignore_tls: bool = False
# Source: https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb

The patch introduces an allow_private_network configuration flag defaulting to False, enforcing host validation before requests are dispatched.

Detection Methods for CVE-2026-54691

Indicators of Compromise

Outbound HTTP requests originating from build agents or developer hosts targeting 169.254.169.254 or other link-local addresses shortly after datamodel-code-generator invocations.
Unexpected requests from CI/CD runners to internal service endpoints (localhost, private subnets) correlated with schema-generation jobs.
Redirect chains in HTTP logs where an external schema URL terminates at an internal IP address.

Detection Strategies

Inspect process command lines for datamodel-codegen --url <target> invocations and correlate them with subsequent outbound network connections.
Monitor egress firewall or proxy logs for requests to RFC 1918, loopback, and cloud metadata addresses initiated by Python processes.
Track installed package versions across build environments and flag any datamodel-code-generator release earlier than 0.61.0.

Monitoring Recommendations

Enable network egress logging on CI runners and developer endpoints, with alerts on connections to instance metadata endpoints.
Alert on HTTP redirects observed by web proxies where the final host resolves to a private or link-local address.
Baseline expected URL destinations for schema-fetching tools and alert on deviations.

How to Mitigate CVE-2026-54691

Immediate Actions Required

Upgrade datamodel-code-generator to version 0.61.0 or later across all developer, build, and runtime environments.
Audit CI/CD pipelines and scripts for --url arguments accepting external or user-supplied values and restrict them to trusted schema sources.
Restrict egress from build systems to only the specific external hosts required for schema retrieval.

Patch Information

The fix is available in datamodel-code-generator version 0.61.0, which adds an allow_private_network option (default False) and validates request targets, including redirect destinations. See the GitHub Security Advisory GHSA-rfr2-mq9m-x2qx, the remediation commit, and the 0.61.0 release notes.

Workarounds

Block outbound traffic from hosts running the tool to internal ranges (127.0.0.0/8, RFC 1918, 169.254.0.0/16) via firewall or egress proxy.
Require IMDSv2 (session-based tokens) on AWS instances to reduce impact of metadata endpoint requests reaching 169.254.169.254.
Pass only vetted, hard-coded schema URLs and disable use of the --url flag with untrusted input where upgrade is not yet possible.

bash

# Upgrade to the patched release
pip install --upgrade 'datamodel-code-generator>=0.61.0'

# Verify installed version
datamodel-codegen --version

# Example egress restriction using iptables on a build runner
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT