{"id":"CVE-2026-85666","title":"OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint","summary":"OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"ogx-ai","product":"ogx","affected":["ogx <= 1.3.1"],"published":"2026-09-04","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:16:59.257","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85666","references":[{"url":"https://github.com/ogx-ai/ogx","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ogx-ai/ogx/blob/v1.3.1/src/ogx/providers/utils/tools/mcp.py","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ogx-ai/ogx/issues/6287","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ogx-1.3.1-server-side-request-forgery-via-mcp-tool-server-url","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85666.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85666"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533309"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85666"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85666"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00415,"epssPercentile":0.35463,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T19:20:32.845571Z"},"ingestedAt":"2026-09-14T20:14:21.166Z","slug":"CVE-2026-85666","body":"## Overview\n\nOGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Lightspeed Core, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, Red Hat OpenShift AI (RHOAI) · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85666.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}