CVE-2026-8768: Vercel AI SSRF Vulnerability

CVE-2026-8768 Overview

CVE-2026-8768 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting the Vercel AI SDK up to version 3.0.97. The flaw resides in the validateDownloadUrl function within packages/provider-utils/src/download-blob.ts, part of the provider-utils component. Attackers can manipulate URL validation logic to coerce the server into issuing requests to attacker-controlled or internal destinations. The issue is exploitable remotely without authentication or user interaction. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.

Critical Impact

Remote, unauthenticated attackers can abuse the SDK's download URL validation to issue server-side requests against internal services, cloud metadata endpoints, or other unintended targets.

Affected Products

• Vercel AI SDK versions up to and including 3.0.97
• The provider-utils package (download-blob.ts)
• Applications embedding the vulnerable validateDownloadUrl function

Discovery Timeline

• 2026-05-17 - CVE-2026-8768 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8768

Vulnerability Analysis

The Vercel AI SDK provides utilities for downloading remote blobs used by AI provider integrations. The validateDownloadUrl function in download-blob.ts is responsible for verifying that a requested URL is safe before the SDK fetches its contents. The validation logic fails to adequately restrict the destinations a request may target. As a result, an attacker who controls input that flows into the download routine can direct the server to make outbound HTTP requests to arbitrary hosts.

The public proof-of-concept demonstrates that the validation can be bypassed and used to reach hosts that should not be accessible from the application context. Because the request originates from the server running the SDK, it inherits any network trust that the host possesses, including access to private subnets and cloud instance metadata services.

Root Cause

The root cause is insufficient input validation in validateDownloadUrl. The function does not robustly enforce an allow-list of acceptable hosts and schemes, and it does not block requests to internal address ranges. Attackers craft URLs that satisfy the existing checks while still resolving to sensitive destinations.

Attack Vector

Exploitation requires only the ability to submit a URL that reaches the vulnerable download path. No authentication is required, and the attack can be launched over the network. A successful request can disclose internal HTTP responses, interact with internal APIs, or probe cloud metadata endpoints depending on the deployment environment. Technical proof-of-concept details are published in the GitHub Gist PoC #1 and GitHub Gist PoC #2.

// No verified exploit code is reproduced here.
// See the referenced GitHub Gist PoCs for technical details
// on bypassing validateDownloadUrl in download-blob.ts.

Detection Methods for CVE-2026-8768

Indicators of Compromise

• Outbound HTTP requests from application servers to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8)
• Requests originating from the Vercel AI SDK runtime to cloud metadata endpoints such as 169.254.169.254
• Unexpected download-blob calls in application logs referencing non-provider hostnames

Detection Strategies

• Inspect application logs for invocations of validateDownloadUrl and download-blob.ts with non-allow-listed URLs
• Correlate egress traffic from AI workloads against an allow-list of known model provider endpoints
• Alert on DNS resolutions to internal or link-local addresses generated by processes hosting the SDK

Monitoring Recommendations

• Enable egress filtering and log all outbound HTTP requests from services that load the vercel:ai package
• Monitor cloud audit logs for instance metadata access from application workloads
• Track installed versions of vercel/ai across the software bill of materials to identify vulnerable deployments

How to Mitigate CVE-2026-8768

Immediate Actions Required

• Identify all applications using vercel/ai at version 3.0.97 or earlier and treat them as exposed until upgraded
• Restrict outbound network access from servers running the SDK to a defined allow-list of provider endpoints
• Block access to cloud instance metadata services from application containers using IMDSv2, network policies, or host firewalls

Patch Information

No vendor advisory or fixed version is referenced in the published CVE data. The disclosure record notes that the vendor was contacted but did not respond. Track the project repository and the VulDB entry #364393 for any future patch information.

Workarounds

• Wrap or replace validateDownloadUrl with a stricter allow-list that limits hosts and schemes to known provider domains over HTTPS only
• Resolve target hostnames before issuing requests and reject responses that map to private, loopback, or link-local addresses
• Route SDK egress through an outbound proxy that enforces destination policy and logs all requests

# Example egress policy: deny SDK traffic to internal and metadata ranges
iptables -A OUTPUT -m owner --uid-owner app -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner app -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner app -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner app -d 192.168.0.0/16 -j REJECT