CVE-2026-85673: LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments exposing the OpenAI-compatible API's multimodal media URL handler are affected. An attacker does not need authentication or user interaction to trigger server-side requests through this handler.
What does an attacker need to bypass the SSRF protection?
The attacker needs control of a URL that redirects to an internal target or whose DNS resolution can be changed after the initial validation. Because redirects and subsequent DNS resolutions are not re-validated, the server can be induced to access internal addresses or cloud metadata endpoints.