CVE-2026-92184: ag-ui-protocol ag-ui SSRF Vulnerability

CVE-2026-92184 Overview

CVE-2026-92184 is a Server-Side Request Forgery (SSRF) vulnerability in ag-ui-protocol ag-ui version 0.3.0. The flaw resides in the urllib.request.urlopen call within integrations/aws-strands/python/src/ag_ui_strands/utils.py, part of the Multimodal Content component. Attackers can manipulate a URL argument to force the server to issue arbitrary outbound HTTP requests. Exploitation requires network access and low-level privileges, and no user interaction is needed. The maintainers have published a fix in commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189, which introduces a URL fetch policy and budget enforcement.

Critical Impact
Remote attackers with low privileges can coerce the ag-ui server into fetching arbitrary URLs, enabling access to internal services, cloud metadata endpoints, and other resources normally unreachable from outside the trust boundary.

Affected Products

ag-ui-protocol ag-ui 0.3.0
integrations/aws-strands/python/src/ag_ui_strands/utils.py (Multimodal Content component)
Deployments using the AWS Strands integration prior to commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189

Discovery Timeline

2026-09-16 - CVE-2026-92184 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92184

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery flaw classified under [CWE-918]. It exists in the AWS Strands integration of ag-ui, which processes multimodal content that may reference remote URLs. When the affected code invokes urllib.request.urlopen on an attacker-influenced value, the server performs the HTTP request on behalf of the caller without validating the destination.

Because the request originates from the ag-ui server process, it inherits that host's network position. Attackers can reach internal-only services, loopback interfaces, and cloud provider metadata endpoints such as http://169.254.169.254/. This class of flaw is a common vector for stealing temporary IAM credentials in AWS-hosted deployments, which is particularly relevant given the AWS Strands integration context.

The patch introduces a UrlFetchPolicy, a DEFAULT_URL_FETCH_POLICY, a UrlFetchPolicyError, and a _FetchBudget construct. These artifacts constrain which URLs may be fetched and cap the number and size of fetches performed per request.

Root Cause

The root cause is missing validation of the URL argument passed into urllib.request.urlopen. The affected function accepted any scheme, host, and IP address, including private, link-local, and loopback ranges. Without an allowlist or destination policy, user-controlled input flowed directly into an outbound HTTP request.

Attack Vector

Exploitation occurs remotely over the network. An authenticated caller submits multimodal content containing a URL that points to an internal resource. The server dereferences that URL, and response data or side effects can be observed by the attacker or used to pivot deeper into the environment.

python

# Security patch excerpt in integrations/aws-strands/python/src/ag_ui_strands/__init__.py
# From merge of PR #2491 (fix/issue-2432-url-source-ssrf)
     plan_a2ui_injection,
 )
 from .client_proxy_tool import create_proxy_tool, sync_proxy_tools
-from .utils import create_strands_app
+from .utils import (
+    DEFAULT_URL_FETCH_POLICY,
+    UrlFetchPolicy,
+    UrlFetchPolicyError,
+    create_strands_app,
+)
 from .endpoint import add_strands_fastapi_endpoint, add_ping
 from .config import (
     StrandsAgentConfig,

Source: GitHub Commit Details

python

# Security patch excerpt in integrations/aws-strands/python/src/ag_ui_strands/agent.py
     maybe_await,
     normalize_predict_state,
 )
-from .utils import convert_agui_content_to_strands, flatten_content_to_text
+from .utils import (
+    UrlFetchPolicy,
+    _FetchBudget,
+    convert_agui_content_to_strands,
+    flatten_content_to_text,
+)

Source: GitHub Commit Details

The patch wires the new UrlFetchPolicy and _FetchBudget primitives into agent execution so that URL fetches performed while resolving multimodal content are subject to policy checks and per-request limits.

Detection Methods for CVE-2026-92184

Indicators of Compromise

Outbound HTTP requests from the ag-ui server process to RFC1918 addresses, loopback (127.0.0.0/8), or link-local ranges (169.254.0.0/16).
Requests originating from the ag-ui host to cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/.
Multimodal content payloads containing URL fields that reference internal hostnames, private IPs, or non-HTTP schemes.

Detection Strategies

Inspect ag-ui application logs for calls into ag_ui_strands/utils.py where URL arguments deviate from expected external content hosts.
Correlate egress firewall or VPC flow logs with ag-ui request logs to identify server-initiated fetches to sensitive internal destinations.
Deploy request-body inspection at API gateways to flag multimodal content whose URL values fail an allowlist check.

Monitoring Recommendations

Alert on any HTTP requests from the ag-ui service account or container to IMDS endpoints, and treat matches as high-priority incidents.
Baseline normal outbound destinations for the ag-ui workload and alert on new or rare destinations.
Enable AWS CloudTrail and GuardDuty findings for UnauthorizedAccess:EC2/MetaDataDNSRebind and credential-exfiltration patterns tied to the workload's IAM role.

How to Mitigate CVE-2026-92184

Immediate Actions Required

Upgrade ag-ui beyond commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 from the ag-ui-protocol repository.
Audit deployments of the ag_ui_strands AWS Strands integration and confirm the URL fetch policy is active.
Rotate any IAM credentials, session tokens, or secrets accessible from the ag-ui host if SSRF activity is suspected.

Patch Information

The fix is available in the merge of pull request #2491, which closes issue #2432. The patch commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 introduces UrlFetchPolicy, DEFAULT_URL_FETCH_POLICY, UrlFetchPolicyError, and _FetchBudget to constrain outbound fetches performed while processing multimodal content. Additional CVE metadata is available in the VulDB Vulnerability Report.

Workarounds

Restrict egress from the ag-ui host so it cannot reach internal RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, or cloud metadata IPs.
Enforce IMDSv2 with a hop limit of 1 on AWS EC2 instances hosting ag-ui to block SSRF-based metadata theft.
Terminate multimodal URL fetching behind a hardened proxy that enforces a scheme and destination allowlist.
Require authentication and rate limiting on the ag-ui endpoints that accept multimodal content until the patch is deployed.

bash

# Example: block ag-ui workload from reaching AWS instance metadata service
iptables -A OUTPUT -m owner --uid-owner ag-ui -d 169.254.169.254 -j REJECT

# Example: enforce IMDSv2 with hop limit 1 on an EC2 instance
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled