CVE-2026-85673 Overview
LLaMA-Factory contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible API multimodal media URL handler. Unauthenticated attackers can bypass the SSRF validation guard to reach internal network addresses and cloud metadata endpoints. The check_ssrf_url function validates a URL once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validating the destination. Attackers exploit this gap using redirect chains or DNS rebinding to pivot from an externally reachable API into internal infrastructure. The flaw is tracked as CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated remote attackers can retrieve cloud instance metadata credentials and probe internal services, enabling lateral movement and potential compromise of the hosting environment.
Affected Products
- LLaMA-Factory OpenAI-compatible chat API
- LLaMA-Factory version v0.9.5 (source referenced in advisory)
- Deployments exposing the LLaMA-Factory API server to untrusted networks
Discovery Timeline
- 2026-09-04 - CVE-2026-85673 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-85673
Vulnerability Analysis
The vulnerability resides in the multimodal media URL handling path of the OpenAI-compatible chat API implemented in src/llamafactory/api/chat.py and src/llamafactory/api/common.py. When a chat request references an image or audio URL, the server invokes check_ssrf_url to reject URLs that resolve to private, loopback, or link-local addresses. After validation passes, the server calls requests.get to fetch the resource for downstream model processing.
The defense fails because validation and fetch are decoupled. The requests.get client follows HTTP 3xx redirects by default and performs a fresh DNS lookup for each hop. Neither the redirect target nor the newly resolved IP address is re-checked against the SSRF allowlist. The result is a classic time-of-check to time-of-use gap layered on top of an incomplete SSRF guard.
Root Cause
The root cause is single-shot input validation over a multi-step network operation. check_ssrf_url inspects the initial URL string and its first DNS resolution, but the HTTP client re-resolves and re-navigates independently. The guard also lacks controls that would close the gap, such as disabling redirects, pinning the resolved IP for the actual socket connection, or re-validating every intermediate hop.
Attack Vector
An unauthenticated attacker submits a chat completion request that includes a multimodal media URL pointing to an attacker-controlled host. Two exploitation paths exist. First, the attacker's server returns an HTTP 302 redirect to an internal target such as http://169.254.169.254/latest/meta-data/ to read cloud metadata. Second, the attacker uses DNS rebinding: the initial resolution returns a public IP that passes validation, and the second resolution during requests.get returns an internal IP such as 127.0.0.1 or an RFC1918 address. Both techniques yield responses from internal services back to the attacker through the LLaMA-Factory response channel or via side effects observable in logs.
The vulnerability mechanism is described in prose only; refer to the VulnCheck SSRF Guard Bypass Advisory and GitHub Issue #10646 for further technical detail.
Detection Methods for CVE-2026-85673
Indicators of Compromise
- Outbound HTTP requests from the LLaMA-Factory host to link-local metadata addresses such as 169.254.169.254, metadata.google.internal, or fd00:ec2::254.
- Chat API requests containing multimodal image_url or audio_url fields that reference external hosts followed by rapid internal fetch activity.
- DNS query patterns where the same hostname resolves to a public IP and shortly afterward to a private or loopback IP.
- HTTP 3xx redirect responses in egress proxy logs originating from LLaMA-Factory user-agent traffic.
Detection Strategies
- Inspect API request bodies for URL fields under messages[].content and correlate with subsequent outbound network flows from the same process.
- Alert on any egress from the model-serving host to RFC1918, loopback, or cloud metadata IP ranges.
- Baseline the DNS resolution behavior of the LLaMA-Factory service and flag hostnames whose resolutions oscillate between public and private ranges.
Monitoring Recommendations
- Enable verbose access logging on the OpenAI-compatible API endpoints and forward logs to a centralized analytics platform.
- Deploy an egress firewall or proxy in front of the model server and log all denied connections to internal ranges.
- Monitor cloud metadata service access counters (IMDS request metrics on AWS, GCP, or Azure) for unexpected spikes originating from the LLaMA-Factory workload.
How to Mitigate CVE-2026-85673
Immediate Actions Required
- Restrict network egress from the LLaMA-Factory host to a minimal allowlist that excludes RFC1918, loopback, link-local, and cloud metadata ranges.
- Enforce IMDSv2 with hop-limit 1 on AWS instances, or the equivalent metadata protections on GCP and Azure, to blunt metadata exfiltration.
- Place the OpenAI-compatible API behind authentication and remove any exposure to untrusted networks until patched.
- Audit recent API logs for suspicious multimodal URL submissions and internal fetch activity.
Patch Information
No fixed version identifier is listed in the NVD entry at time of publication. Track the LLaMA-Factory repository and GitHub Issue #10646 for the upstream fix. A robust patch should disable HTTP redirects on the media fetch, pin the validated IP address for the actual socket connection, and re-validate every hop against the SSRF allowlist.
Workarounds
- Disable multimodal media URL processing in the OpenAI-compatible API if the feature is not required.
- Front the API with a reverse proxy that strips or validates image_url and audio_url fields before they reach LLaMA-Factory.
- Run the LLaMA-Factory process inside a network namespace or container with no route to internal management networks or metadata services.
- Configure the underlying HTTP client through environment or wrapper code to reject redirects and enforce IP pinning for fetched resources.
# Example egress control blocking metadata and private ranges via iptables
iptables -A OUTPUT -m owner --uid-owner llamafactory -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner llamafactory -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner llamafactory -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner llamafactory -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner llamafactory -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
