CVE-2026-77294: TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted import path. The value is consumed by the clients in server/src/nest/llm-parse/clients/openai-compatible.client.ts, server/src/nest/llm-parse/clients/anthropic.client.ts, and server/src/nest/llm-parse/router/ollama-format.client.ts without applying the server-side request forgery guard. Triggering AI-assisted trip parsing causes the server to request the supplied destination, and upstream error response text can be returned in parsing warnings. This permits internal service discovery and access to link-local cloud metadata, with possible disclosure of infrastructure credentials and subsequent modification of protected cloud resources. This issue is fixed in version 3.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TREKto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated TREK user must be able to save settings through the settings API and have write permission on the target trip instance. Exploitation also requires the LLM_PARSING feature to be enabled.
What action triggers the server-side request?
The attacker stores a controlled llm_base_url, then triggers the AI-assisted trip parsing or import path for a trip they can modify. The server sends a request to the supplied destination through one of the affected LLM client paths.
What could an attacker obtain through this vulnerability?
The issue permits internal-service discovery and requests to link-local cloud metadata endpoints. Error text returned by the upstream destination may appear in parsing warnings, and exposed cloud credentials could enable modification of protected cloud resources.
How can this be remediated?
Upgrade TREK to version 3.3.0, which fixes the issue.