CVE-2026-85666: ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validateurlnotprivate() guard used for other URL inputs is not applied to serverurl. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply destination validation for MCP tool definitions’ server_url: ensure the server-side fetcher applies the same validate_url_not_private() guard (or equivalent) to server_url to block private/internal and link-local destinations such as http://169.254.169.254/.
- Compensating control
Restrict exposure of the OpenAI-compatible POST /v1/responses endpoint so unauthenticated requests are not allowed (default starter configuration runs without authentication).
- Compensating control
Disable or require authentication/authorization for MCP tool server_url usage in the default starter configuration so unauthenticated users cannot trigger server-side requests to arbitrary internal addresses.
Event History
Frequently Asked Questions
Which deployments are exposed to remote unauthenticated exploitation?
The default starter configuration is exposed because it runs without authentication. A remote attacker can target the OpenAI-compatible POST /v1/responses endpoint without credentials.
What does an attacker need to supply to exploit this issue?
The attacker needs to submit an MCP tool definition containing a server_url. They can also provide headers and authorization values that the server will forward when it fetches that URL.
What internal resources could be reached?
The server can be induced to connect to arbitrary internal addresses because server_url has no destination validation. This includes cloud metadata endpoints such as http://169.254.169.254/.
How can I determine whether my deployment is affected?
Check whether the deployment uses OGX at the affected commit fbe8e0f or the identified 1.3.1 code path, and whether MCP tool server_url values reach the POST /v1/responses endpoint without URL validation. Deployments using the default unauthenticated starter configuration should be treated as exposed.