CVE-2026-86259: OpenMAIC SSRF Vulnerability

CVE-2026-86259 Overview

CVE-2026-86259 is a Server-Side Request Forgery (SSRF) vulnerability in OpenMAIC versions before 1.0.1. The application skips SSRF validation in non-production builds, allowing unauthenticated attackers to control the destination of outbound HTTP requests issued by the server. Attackers supply arbitrary provider URLs through the x-base-url header or the baseUrl parameter to redirect requests toward internal services, including cloud instance metadata endpoints. Successful exploitation exposes cloud credentials and sensitive metadata associated with the hosting environment. The vulnerability is tracked under GitHub Security Advisory GHSA-9m7h-vh2h-rc3w and remediated in OpenMAIC Release v1.0.1.

Critical Impact
Unauthenticated attackers can reach cloud instance metadata services (IMDS) and extract temporary cloud credentials from OpenMAIC deployments running non-production builds.

Affected Products

OpenMAIC versions prior to 1.0.1
OpenMAIC v1.0.0 (confirmed vulnerable via referenced source code)
Deployments running non-production builds where SSRF validation is bypassed

Discovery Timeline

2026-09-06 - CVE-2026-86259 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86259

Vulnerability Analysis

OpenMAIC exposes an image generation API route that constructs outbound requests to an AI provider. The provider endpoint is derived from user-controlled inputs, specifically the x-base-url HTTP header or the baseUrl request parameter. In production builds, SSRF validation restricts these values to an allowlist of trusted providers. In non-production builds, that validation is skipped entirely, leaving the outbound request destination fully attacker-controlled. Relevant call sites are documented in the OpenMAIC Image Route Code and the OpenMAIC Middleware Code.

Root Cause

The root cause is missing authentication and missing input validation on a security-sensitive code path [CWE-306]. The middleware gates SSRF checks on the runtime environment rather than applying them universally. When NODE_ENV is not production, request URLs bypass allowlist enforcement and are passed directly to the server-side fetch client.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the OpenMAIC image generation endpoint. The attacker sets the x-base-url header or baseUrl parameter to an internal target such as http://169.254.169.254/latest/meta-data/ on AWS or http://metadata.google.internal/ on GCP. The server issues the request from its own network position and returns the response body to the attacker, disclosing instance metadata and IAM credentials. Additional analysis is available in the VulnCheck Advisory for OpenMAIC.

Detection Methods for CVE-2026-86259

Indicators of Compromise

Inbound HTTP requests to OpenMAIC endpoints containing an x-base-url header or baseUrl parameter pointing to RFC1918, loopback, or link-local addresses
Outbound server-side requests from OpenMAIC hosts to 169.254.169.254, metadata.google.internal, or 100.100.100.200
Anomalous use of cloud IAM credentials associated with the OpenMAIC workload from unfamiliar source IP addresses or user agents

Detection Strategies

Inspect web server and reverse proxy logs for requests to /api/generate/image that include the x-base-url header
Correlate application logs with egress network telemetry to identify server-initiated requests targeting internal metadata IP ranges
Alert on any OpenMAIC deployment where the runtime environment variable is not set to production and the service is exposed to untrusted networks

Monitoring Recommendations

Enable egress filtering logs on cloud workloads and forward them to a centralized data lake for correlation
Monitor cloud audit trails (AWS CloudTrail, GCP Audit Logs, Azure Activity Logs) for use of instance role credentials from unexpected sources
Track deployment configuration drift to identify OpenMAIC instances running non-production builds in externally reachable environments

How to Mitigate CVE-2026-86259

Immediate Actions Required

Upgrade OpenMAIC to version 1.0.1 or later immediately using the OpenMAIC Release v1.0.1
Rotate any cloud IAM credentials, API keys, or secrets accessible from the OpenMAIC host through instance metadata
Restrict inbound access to OpenMAIC endpoints until the patch is deployed and verified

Patch Information

The vendor released OpenMAIC v1.0.1, which applies SSRF validation to all builds regardless of environment. Refer to the GitHub Security Advisory GHSA-9m7h-vh2h-rc3w for full remediation guidance and the OpenMAIC GitHub Repository for source changes.

Workarounds

Enforce IMDSv2 with hop limit of 1 on AWS EC2 instances hosting OpenMAIC to prevent metadata retrieval via SSRF
Block egress traffic from OpenMAIC workloads to 169.254.169.254, metadata.google.internal, and other link-local metadata endpoints at the network layer
Ensure the runtime environment variable is explicitly set to production for all deployments where the patch cannot be applied immediately

bash

# Configuration example: enforce IMDSv2 and block metadata egress
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Deny egress to cloud metadata services via iptables
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 100.100.100.200 -j DROP