CVE-2026-92215: a2ui FileResolver SSRF Vulnerability

CVE-2026-92215 Overview

A server-side request forgery (SSRF) vulnerability affects the a2ui-project a2ui package through version 0.10.7. The flaw resides in the httpx.get call within the FileResolver component, specifically in agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. An unauthenticated remote attacker can manipulate the request destination to force the server to issue HTTP requests to attacker-chosen targets. The issue is tracked under CWE-918: Server-Side Request Forgery and is fixed by commit 2bb8423060308bbdea8ba468dabed4fc256d18ea.

Critical Impact
Remote, unauthenticated attackers can coerce the a2ui agent server to send arbitrary HTTP requests, enabling internal network reconnaissance and access to cloud metadata endpoints.

Affected Products

a2ui-project a2ui versions up to and including 0.10.7
a2ui_agent Python SDK containing the FileResolver extension
Deployments referencing agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py

Discovery Timeline

2026-09-16 - CVE-2026-92215 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92215

Vulnerability Analysis

The FileResolver component in the a2ui agent SDK exposes an HTTP file-fetch capability backed by httpx.get. The resolver accepts a URL and issues an outbound HTTP request without validating the destination host against an allowlist. Because the request originates from the server process, attackers can pivot through the agent to reach internal-only services, cloud instance metadata endpoints, and other network resources otherwise unreachable from the internet. The vulnerability is exploitable remotely and does not require authentication or user interaction.

Root Cause

The FileResolver constructor did not enforce an allowed_hosts restriction. Any URL passed into the resolver was fetched directly by httpx.get, giving attacker-controlled input direct influence over the outbound HTTP request destination. This is a classic SSRF pattern where trust boundaries between user input and outbound network requests were not enforced.

Attack Vector

An attacker submits a request to an a2ui agent endpoint that invokes the FileResolver, supplying a URL pointing to an internal service, http://169.254.169.254/ for cloud metadata, or a private-network address such as http://10.0.0.1/. The a2ui server issues the request server-side and may return response content, headers, or timing signals that leak information about internal infrastructure.

python

# Patch applied in commit 2bb8423060308bbdea8ba468dabed4fc256d18ea
# samples/community/agent/adk/file_upload_summarizer/file_resolution.py
resolver = FileResolver(
    allowed_mime_types=ALLOWED_MIME_TYPES,
    allowed_hosts=[],
    custom_schemes={MOCK_DRIVE_SCHEME: _mock_drive_handler},
    http_client=_http_client,
)

Source: GitHub Commit Details. The fix introduces an allowed_hosts parameter, forcing callers to explicitly declare which hosts the resolver is permitted to contact.

Detection Methods for CVE-2026-92215

Indicators of Compromise

Outbound HTTP requests from the a2ui agent process to RFC1918 addresses, 127.0.0.1, or 169.254.169.254
Unexpected httpx User-Agent traffic in egress logs directed at internal service ports
Application logs showing FileResolver invocations with URLs referencing non-public hosts

Detection Strategies

Instrument the a2ui service to log the resolved destination host for every FileResolver call and alert on private or link-local ranges.
Deploy egress network monitoring on hosts running the a2ui agent and flag requests to cloud metadata IPs and internal subnets.
Review web access logs for repeated file-resolution requests with atypical URL schemes or parameters targeting scheme-based bypasses.

Monitoring Recommendations

Alert on any HTTP 200 responses from cloud metadata endpoints originating from a2ui agent hosts.
Track anomalous spikes in outbound requests from agent workloads that exceed baseline volumes.
Correlate FileResolver audit events with authentication logs to identify unauthenticated exploitation attempts.

How to Mitigate CVE-2026-92215

Immediate Actions Required

Upgrade a2ui beyond version 0.10.7 to a release containing commit 2bb8423060308bbdea8ba468dabed4fc256d18ea.
Configure FileResolver with an explicit allowed_hosts list restricted to trusted external file providers.
Block outbound access from a2ui agent hosts to cloud metadata IPs and internal management networks at the network layer.

Patch Information

The upstream fix is available in GitHub Pull Request #2390 and merged as commit 2bb8423060308bbdea8ba468dabed4fc256d18ea. Additional context is tracked in GitHub Issue #2295 and cataloged in the VulDB CVE-2026-92215 record. Apply the patch by upgrading to a fixed release or by cherry-picking the referenced commit into the deployed branch.

Workarounds

Wrap httpx.get invocations in a resolver that validates destination hostnames against a strict allowlist before dispatch.
Route agent egress through an authenticated forward proxy that denies requests to private address ranges and cloud metadata endpoints.
Disable the FileResolver extension in environments that do not require remote file fetching.

bash

# Example egress firewall rules blocking SSRF-attractive destinations
iptables -A OUTPUT -m owner --uid-owner a2ui -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner a2ui -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner a2ui -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner a2ui -d 192.168.0.0/16 -j REJECT