CVE-2026-86237: OpenAgents SSRF Vulnerability

CVE-2026-86237 Overview

CVE-2026-86237 is a server-side request forgery (SSRF) vulnerability affecting openagents-org openagents versions up to 0.8.19 and 0.9.3.post20. The flaw resides in the test_default_model function within sdk/src/openagents/sdk/transports/http.py. An attacker can manipulate the base_url argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is remotely exploitable over the network without authentication or user interaction. Public exploit details are available, and the identical unguarded code still ships in 0.9.3.post20 despite the maintainer marking the report inapplicable. Sibling admin endpoints in the project call _require_admin(), but this handler does not.

Critical Impact
Unauthenticated remote attackers can force the OpenAgents server to issue outbound HTTP requests to attacker-chosen destinations, enabling internal network reconnaissance and metadata service abuse.

Affected Products

openagents-org openagents up to and including version 0.8.19
openagents-org openagents version 0.9.3.post20
The test_default_model handler in sdk/src/openagents/sdk/transports/http.py

Discovery Timeline

2026-09-07 - CVE-2026-86237 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86237

Vulnerability Analysis

The vulnerability is a server-side request forgery (SSRF) classified under [CWE-918]. It exists in the test_default_model function in sdk/src/openagents/sdk/transports/http.py. This handler accepts a caller-supplied base_url parameter and uses it directly to construct outbound HTTP requests. No allow-list, scheme restriction, or destination validation is performed before the request is dispatched. The handler also lacks the _require_admin() guard that protects sibling administrative endpoints in the same project.

An attacker who can reach the OpenAgents HTTP interface can therefore submit an arbitrary URL and force the server to connect to it. This includes internal RFC1918 addresses, loopback services, and cloud metadata endpoints such as 169.254.169.254. Publicly released details indicate the endpoint and both sinks remain unchanged between the reported vulnerable releases, and the file was only relocated in commit e277dd1a.

Root Cause

The root cause is missing input validation on the base_url argument combined with a missing authorization check. User-controlled input flows directly into an HTTP client sink without normalization, scheme filtering, or destination allow-listing.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted request to the exposed handler with base_url pointing at an internal, loopback, or cloud metadata target. The OpenAgents server then acts as a proxy, issuing the request from its own trust context. Attackers can enumerate internal services, retrieve response content that leaks in error paths, or attempt to reach systems that trust the server's source address.

See the GitHub Issue #566 Discussion and the VulDB CVE-2026-86237 Entry for the disclosed technical details.

Detection Methods for CVE-2026-86237

Indicators of Compromise

Outbound HTTP requests from the OpenAgents host to internal RFC1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Inbound requests to the test_default_model endpoint containing non-standard base_url values referencing internal hostnames, IP literals, or non-HTTP schemes.
Unexpected DNS resolutions for internal service names originating from the OpenAgents process.

Detection Strategies

Inspect application and reverse-proxy logs for requests that invoke the test_default_model handler with attacker-controlled base_url parameters.
Correlate inbound API requests with subsequent outbound connections from the OpenAgents process to identify request forgery patterns.
Alert on outbound traffic from the OpenAgents workload to link-local, loopback, or private address space that should not be a normal destination.

Monitoring Recommendations

Enable egress logging on the host running OpenAgents and forward it to a centralized analytics platform for baseline deviation analysis.
Instrument the Python HTTP client with structured logging that records the resolved destination for every request originating from the SDK transport.
Track versions in use across environments and flag any deployment still running 0.8.19 or 0.9.3.post20.

How to Mitigate CVE-2026-86237

Immediate Actions Required

Restrict network access to the OpenAgents HTTP interface so that only trusted callers can reach the test_default_model endpoint.
Deploy egress filtering that blocks the OpenAgents workload from reaching RFC1918 ranges, loopback, and cloud metadata endpoints unless explicitly required.
Audit application logs for prior invocations of the vulnerable handler containing suspicious base_url values.

Patch Information

At the time of publication, the maintainer closed the report as inapplicable and the vulnerable code still ships in 0.9.3.post20. No official fixed release is available. Track the GitHub OpenAgents Repository and the referenced GitHub Issue #566 Discussion for future remediation. Downstream operators should apply local patches that validate the base_url argument against a strict allow-list and add an authorization check equivalent to _require_admin().

Workarounds

Apply a local fork or monkey-patch to sdk/src/openagents/sdk/transports/http.py that rejects non-HTTPS schemes and any host resolving to private, loopback, or link-local addresses.
Add an authentication and authorization requirement in front of the test_default_model handler, mirroring the _require_admin() guard used on sibling admin endpoints.
Place the OpenAgents service behind a reverse proxy that enforces destination allow-listing and drops requests carrying internal hostnames in the base_url parameter.

bash

# Example egress restriction using iptables to block SSRF targets from the OpenAgents host
iptables -A OUTPUT -m owner --uid-owner openagents -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openagents -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openagents -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openagents -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openagents -d 192.168.0.0/16 -j REJECT