CVE-2026-85666 Overview
CVE-2026-85666 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in OGX (formerly Llama Stack), affecting the OpenAI-compatible POST /v1/responses endpoint. Model Context Protocol (MCP) tool definitions accept a server_url parameter that the server fetches without destination validation. The existing validate_url_not_private() guard applied to other URL inputs is not invoked for server_url. On the default starter configuration, which runs without authentication, remote attackers can force the server to connect to arbitrary internal addresses, including cloud metadata endpoints such as http://169.254.169.254/, and forward attacker-controlled headers and bearer tokens to those destinations.
Critical Impact
Unauthenticated remote attackers can reach internal-only services and cloud metadata endpoints, potentially exfiltrating cloud instance credentials and other confidential data.
Affected Products
- OGX (formerly Llama Stack) at commit fbe8e0f
- OGX version 1.3.1
- Deployments using the default starter configuration (no authentication)
Discovery Timeline
- 2026-09-04 - CVE-2026-85666 published to the National Vulnerability Database
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-85666
Vulnerability Analysis
The flaw resides in OGX's MCP tool handling logic in src/ogx/providers/utils/tools/mcp.py. When a client submits a request to POST /v1/responses, it can include MCP tool definitions containing a server_url field along with arbitrary headers and authorization tokens. OGX fetches the specified URL server-side to interact with the MCP endpoint but skips destination validation.
Other URL-accepting inputs in OGX are protected by a validate_url_not_private() helper that blocks requests to loopback, link-local, and private address ranges. This helper is not called for server_url, leaving the code path exposed. Because the default starter profile ships with authentication disabled, no credentials are required to trigger the request.
Root Cause
The root cause is missing SSRF protection on a single request handler. Input validation logic exists in the codebase but is inconsistently applied. The server_url parameter bypasses the sanitization used elsewhere, so any hostname, including RFC 1918 addresses, link-local ranges, and the AWS/GCP/Azure instance metadata IP 169.254.169.254, is accepted and dereferenced.
Attack Vector
An attacker sends an HTTP POST to /v1/responses on an exposed OGX instance. The request body includes an MCP tool definition where server_url points to an internal target, with headers or an authorization bearer token that the attacker wants relayed. The OGX server issues an outbound request to the attacker-chosen destination and returns the response contents, enabling metadata service credential theft, internal service enumeration, and reflected access to authenticated internal endpoints. See the VulnCheck Advisory for OGX 1.3.1 and the OGX MCP tool source for the affected code path.
Detection Methods for CVE-2026-85666
Indicators of Compromise
- Outbound connections from OGX hosts to 169.254.169.254, metadata.google.internal, or metadata.azure.com.
- Unexpected outbound requests from OGX processes to RFC 1918 addresses or 127.0.0.0/8.
- Inbound HTTP requests to /v1/responses containing MCP tool definitions with server_url values pointing to internal or metadata hosts.
Detection Strategies
- Inspect OGX access logs for POST /v1/responses requests and parse the JSON body for server_url values referencing private, loopback, or link-local IP ranges.
- Monitor egress traffic from OGX workloads and alert on any request to cloud instance metadata endpoints.
- Correlate outbound requests from the OGX service account with the arrival of /v1/responses traffic from untrusted networks.
Monitoring Recommendations
- Enable verbose HTTP logging for the OGX API and forward logs to a centralized analytics platform for retention and search.
- Deploy egress firewall rules that alert or block on connections from OGX pods or hosts to metadata service IP addresses.
- Track anomalous authentication activity on cloud IAM roles associated with the OGX host, which could indicate metadata credential abuse.
How to Mitigate CVE-2026-85666
Immediate Actions Required
- Restrict network access to OGX so that only trusted clients can reach /v1/responses, and place the service behind an authenticating reverse proxy.
- Block egress from OGX workloads to 169.254.169.254 and other cloud metadata endpoints using host firewalls, security groups, or network policies.
- Enforce Instance Metadata Service v2 (IMDSv2) on AWS EC2 hosts to require session tokens that SSRF payloads cannot easily obtain.
- Audit recent OGX request logs for suspicious server_url values and rotate any cloud credentials that may have been exposed.
Patch Information
No fixed version is documented in the referenced advisory at the time of publication. Track the upstream GitHub Issue #6287 and the OGX repository for a patched release, and upgrade as soon as a fix that applies validate_url_not_private() to server_url is available.
Workarounds
- Enable authentication on OGX rather than running the default starter configuration exposed to untrusted networks.
- Deploy an API gateway or WAF rule that inspects POST /v1/responses bodies and rejects MCP tool definitions with server_url values matching private, loopback, or link-local ranges.
- Run OGX inside a network namespace or container with an egress policy that whitelists only required outbound destinations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.