CVE-2026-94040: vas3k TaxHacker SSRF Vulnerability

CVE-2026-94040 Overview

CVE-2026-94040 is a Server-Side Request Forgery (SSRF) vulnerability affecting vas3k TaxHacker versions up to and including 0.8.5. The flaw resides in the testLLMProviderAction function within the app/(app)/apps/settings/actions.ts file. An attacker can manipulate the provider, apiKey, model, or baseUrl arguments to coerce the server into issuing arbitrary outbound requests. The vulnerability is classified under CWE-918 and is exploitable remotely without authentication. A public exploit has been disclosed, and the maintainer has not yet responded to the upstream issue report.

Critical Impact
Remote unauthenticated attackers can abuse the LLM provider test endpoint to send server-originated requests to arbitrary URLs, enabling internal network reconnaissance and metadata service abuse.

Affected Products

vas3k TaxHacker versions up to 0.8.5
Affected component: app/(app)/apps/settings/actions.ts
Affected function: testLLMProviderAction

Discovery Timeline

2026-09-20 - CVE-2026-94040 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94040

Vulnerability Analysis

The vulnerability exists in TaxHacker's LLM provider testing workflow. The testLLMProviderAction server action accepts user-supplied parameters that define an LLM provider endpoint, including the baseUrl used to reach the API. Because these inputs are not validated or restricted against an allowlist, the server treats attacker-controlled URLs as legitimate provider targets. When the action executes, the TaxHacker backend issues an HTTP request to the attacker-defined destination using its own network identity and privileges.

The issue is remotely reachable with no authentication required and no user interaction, per the published advisory metadata. Publicly available exploit details increase the likelihood of opportunistic scanning against exposed TaxHacker instances.

Root Cause

The root cause is missing validation of URL and endpoint parameters passed to the LLM provider test routine. The provider, apiKey, model, and baseUrl arguments flow directly into an outbound HTTP client without filtering internal address ranges, cloud metadata endpoints, or non-HTTP schemes. This matches the pattern described by CWE-918: Server-Side Request Forgery.

Attack Vector

An unauthenticated remote attacker submits a crafted request that invokes testLLMProviderAction with a baseUrl pointing to an internal service, a cloud provider metadata endpoint such as 169.254.169.254, or another sensitive host. The TaxHacker server performs the outbound request on the attacker's behalf. The attacker can enumerate internal services, probe reachability of backend infrastructure, and potentially harvest tokens exposed through cloud instance metadata services.

No verified proof-of-concept code is republished here. See the GitHub TaxHacker Issue #187 and VulDB CVE-2026-94040 entry for technical details.

Detection Methods for CVE-2026-94040

Indicators of Compromise

Outbound HTTP requests from the TaxHacker application host to link-local addresses such as 169.254.169.254 or private RFC1918 ranges that do not correspond to legitimate LLM providers.
Application logs showing invocations of testLLMProviderAction with baseUrl values pointing to non-provider domains or raw IP addresses.
Unexpected DNS lookups originating from the TaxHacker process for attacker-controlled or internal-only hostnames.

Detection Strategies

Instrument the TaxHacker settings action handler to log the full baseUrl submitted to testLLMProviderAction and alert on deviations from an approved provider list.
Deploy egress filtering that blocks outbound traffic from the application host to cloud metadata endpoints and internal management interfaces, and alert on denied connections.
Correlate web request logs with outbound network telemetry to identify request-response pairs consistent with SSRF probing.

Monitoring Recommendations

Monitor for spikes in requests to the settings route that invokes provider testing, particularly from unauthenticated or new source IPs.
Track outbound connection destinations from the TaxHacker container or host and baseline them against known LLM API endpoints.
Enable alerting on any access attempts to cloud instance metadata services from application workloads.

How to Mitigate CVE-2026-94040

Immediate Actions Required

Remove TaxHacker from public network exposure until a patched release is available, and restrict access to trusted operators only.
Enforce network-layer egress controls that block the application host from reaching cloud metadata IPs and internal management subnets.
Rotate any credentials, API keys, or cloud instance role tokens that could have been reachable from the TaxHacker host.

Patch Information

At the time of publication, the upstream project has not published a fix. The maintainer was notified via GitHub TaxHacker Issue #187 but has not responded. Track the vas3k TaxHacker repository for a release addressing versions after 0.8.5.

Workarounds

Place TaxHacker behind an authenticating reverse proxy so unauthenticated requests cannot reach the settings action.
Configure an outbound HTTP proxy for the TaxHacker workload and restrict allowed destinations to a fixed allowlist of LLM provider domains.
Deny the TaxHacker host access to 169.254.169.254/32 and other cloud metadata endpoints at the host firewall or cloud security group level.
Disable the LLM provider testing feature in deployments where it is not required, if a configuration option is available.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner taxhacker -d 192.168.0.0/16 -j REJECT