CVE-2026-85686: ms-swift SSRF Vulnerability

CVE-2026-85686 Overview

CVE-2026-85686 is a server-side request forgery (SSRF) vulnerability [CWE-918] in ms-swift version 4.5.2. The flaw resides in the swift deploy OpenAI-compatible API, which fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to force the server into issuing requests to internal services and cloud metadata endpoints. This exposes internal infrastructure and can lead to credential theft from cloud metadata services such as the AWS Instance Metadata Service (IMDS).

Critical Impact
Unauthenticated remote attackers can pivot from the ms-swift API into internal networks and exfiltrate cloud instance credentials via metadata endpoints.

Affected Products

ms-swift 4.5.2 (swift deploy OpenAI-compatible API)
Deployments exposing the ms-swift multimodal inference endpoint
Cloud-hosted ms-swift instances with access to metadata services (AWS, Azure, GCP)

Discovery Timeline

2026-09-04 - CVE-2026-85686 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85686

Vulnerability Analysis

The vulnerability exists in the multimodal media handling logic of ms-swift's OpenAI-compatible inference API. When a client submits an inference request containing image_url, audio_url, or video_url fields, the server retrieves the referenced resource for processing by the model. The URL fetching code in swift/template/vision_utils.py does not validate the destination, restrict URL schemes, block private IP ranges, or filter HTTP redirects.

An attacker can point these parameters at internal HTTP services, loopback addresses, or cloud metadata endpoints. The server performs the outbound request from its own network position, returning content or side-channel information to the attacker. Because the endpoint requires no authentication, exploitation is possible over the network without prior access. This is a classic SSRF pattern applied to an AI inference pipeline that treats user-supplied URLs as trusted media sources.

Root Cause

The root cause is missing URL validation in the multimodal media fetching path. The code accepts arbitrary user-supplied URLs and follows redirects without enforcing an allowlist of hosts or blocking link-local and private address ranges. See GitHub Issue #9740 and the VulnCheck Advisory for MS-Swift for reference details.

Attack Vector

Exploitation requires only network access to the exposed swift deploy API. An attacker submits a crafted JSON request to the OpenAI-compatible chat completions endpoint with a multimodal message where the media URL points to an internal address such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS. The server issues the request and processes the response as media, potentially disclosing metadata content or enabling internal service enumeration through response timing and error signaling.

The vulnerability is described in prose only; no verified public proof-of-concept code is included here. Refer to the GitHub MS-Swift Repository and GitHub Vision Utils Script for the affected source.

Detection Methods for CVE-2026-85686

Indicators of Compromise

Outbound HTTP requests from ms-swift hosts to 169.254.169.254, metadata.google.internal, or metadata.azure.com
Requests from ms-swift processes to RFC1918 addresses, loopback, or link-local ranges not part of normal operation
Inference API requests containing image_url, audio_url, or video_url values referencing internal hostnames or non-standard ports

Detection Strategies

Inspect application logs for swift deploy requests where multimodal URL parameters reference private, loopback, or metadata addresses
Monitor egress network flows from inference servers for unexpected destinations, particularly cloud metadata IPs
Alert on HTTP responses returned to the model pipeline that contain IAM credential structures or metadata JSON keys

Monitoring Recommendations

Enable verbose request logging on the ms-swift API and forward logs to a centralized analytics platform for correlation
Deploy egress filtering telemetry to capture DNS and HTTP destinations initiated by inference workloads
Instrument cloud metadata service access with audit logging where the platform supports it, such as AWS IMDSv2 access logs via VPC flow logs and CloudTrail

How to Mitigate CVE-2026-85686

Immediate Actions Required

Restrict network exposure of the swift deploy API to trusted clients using firewall rules or a reverse proxy with authentication
Enforce IMDSv2 with hop-limit of 1 on AWS instances hosting ms-swift to prevent SSRF-based credential theft
Block outbound traffic from ms-swift hosts to cloud metadata IPs and internal management networks at the egress firewall
Review recent inference request logs for image_url, audio_url, or video_url values referencing internal or metadata addresses

Patch Information

As of the NVD publication date, no fixed release is referenced in the enriched data. Track the GitHub MS-Swift Repository and GitHub Issue #9740 for upstream fix availability. Until an official patch lands, apply compensating controls at the network and proxy layer.

Workarounds

Front the ms-swift API with a reverse proxy that validates multimodal URLs against an allowlist of trusted media hosts
Configure the container or host network namespace to deny routes to 169.254.169.254 and RFC1918 destinations that are not required
Run ms-swift under a dedicated service account and cloud role with minimum IAM permissions to limit blast radius of any credential exposure
Disable multimodal endpoints entirely if image, audio, and video inputs are not required for the deployment

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner swift -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner swift -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner swift -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner swift -d 192.168.0.0/16 -j REJECT

# AWS: enforce IMDSv2 with hop limit 1
aws ec2 modify-instance-metadata-options \
  --instance-id i-EXAMPLE \
  --http-tokens required \
  --http-put-response-hop-limit 1