CVE-2026-85662: Marqo SSRF Vulnerability

CVE-2026-85662 Overview

CVE-2026-85662 is a server-side request forgery (SSRF) vulnerability in Marqo version 2.26.0, an open-source vector search engine. The flaw resides in the add_documents endpoint, which processes media field values without validating destination URLs. Unauthenticated attackers can supply crafted media URLs to force the server into issuing HTTP requests to arbitrary hosts. This enables access to internal-only services and cloud provider metadata endpoints such as the AWS Instance Metadata Service (IMDS). The vulnerability is classified as [CWE-918] Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can pivot into internal networks and retrieve cloud metadata credentials by abusing the media ingestion pipeline.

Affected Products

Marqo 2.26.0
Marqo download_image_from_url function in the inference orchestrator
Marqo fetch_content_sample function in the media download pipeline

Discovery Timeline

2026-09-04 - CVE-2026-85662 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85662

Vulnerability Analysis

Marqo exposes an add_documents REST endpoint that accepts documents containing media fields such as image URLs. When Marqo processes these fields, the inference orchestrator calls download_image_from_url and fetch_content_sample to retrieve remote content for embedding generation. Neither function enforces destination filtering, host allowlisting, or IP address validation before issuing the outbound HTTP request.

An unauthenticated attacker submits a document whose media field points to an internal address such as http://127.0.0.1, http://169.254.169.254, or a private RFC1918 host. Marqo's backend fetches the URL server-side and, depending on error handling, may expose response content or side-channel behavior to the attacker. The impact scope is limited to confidentiality of retrievable content and network reachability abuse.

Root Cause

The root cause is missing input validation on user-supplied media URLs in the media download and preprocessing layer. The image_download.py module in the inference_orchestrator service dispatches HTTP requests without checking whether the resolved host targets loopback, link-local, or private address ranges. See the GitHub Image Download Script for the affected code path.

Attack Vector

Exploitation requires only network reachability to the Marqo API. The attacker sends a POST request to add_documents with a media field containing the target URL. Marqo initiates the request from its own network context, bypassing perimeter controls. On cloud deployments, attackers commonly target http://169.254.169.254/latest/meta-data/ to enumerate instance metadata and, on IMDSv1 nodes, retrieve temporary IAM credentials. Full technical details are documented in the VulnCheck Advisory for Marqo 2.26.0 and GitHub Issue #1452.

Detection Methods for CVE-2026-85662

Indicators of Compromise

Outbound HTTP requests from Marqo hosts to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that do not match normal media source domains.
POST requests to /indexes/*/documents containing media URLs referencing loopback, link-local, or private IP ranges.
Unexpected access patterns to cloud metadata endpoints originating from container or VM instances running Marqo.

Detection Strategies

Deploy egress network monitoring to alert on Marqo pods or hosts contacting internal management interfaces or metadata services.
Inspect Marqo application logs for download_image_from_url and fetch_content_sample invocations targeting non-public hosts.
Correlate spikes in add_documents request volume with anomalous outbound connections from the same workload.

Monitoring Recommendations

Enable VPC flow logs and cloud provider metadata access logs, then baseline expected callers.
Instrument the Marqo API gateway to record submitted media URLs for post-incident forensic review.
Alert on any use of IMDSv1 credentials from IP addresses that do not match the issuing instance.

How to Mitigate CVE-2026-85662

Immediate Actions Required

Restrict network access to the Marqo API so only authenticated internal services can submit documents.
Enforce IMDSv2 on AWS instances hosting Marqo to require session tokens for metadata requests.
Apply egress firewall rules that block Marqo workloads from reaching 169.254.169.254 and internal management subnets.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for Marqo. Monitor the GitHub Marqo Repository and GitHub Issue #1452 for a patched release addressing the SSRF in download_image_from_url and fetch_content_sample.

Workarounds

Front the Marqo API with a reverse proxy that validates media URLs and rejects private, loopback, or link-local destinations before forwarding requests.
Deploy Marqo inside a network segment with no route to cloud metadata services or internal admin interfaces.
Rotate any IAM credentials associated with Marqo instances if SSRF activity is suspected in logs.

bash

# Example: enforce IMDSv2 on an existing AWS EC2 instance hosting Marqo
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled