CVE-2026-86237: openagents-org openagents http.py test_default_model server-side request forgery
A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler requireadmin().
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for triage?
Deployments running openagents versions up to 0.8.19 or 0.9.3.post20 should be assessed, particularly where remote users can reach the handler that invokes test_default_model. The issue can be initiated remotely and requires no privileges or user interaction according to the supplied vector.
What must an attacker be able to control?
An attacker needs to manipulate the base_url argument passed to test_default_model in sdk/src/openagents/sdk/transports/http.py. This causes the server to make a request to an attacker-selected destination.
Is there evidence that this handler enforces the available admin authorization check?
No. The supplied information states that sibling administrative endpoints call _require_admin(), but this handler does not use that shipped authorization check.
How can we assess whether our code is still affected?
Review the implementation of test_default_model and its reachable endpoint for unguarded use of base_url, and verify whether _require_admin() is invoked for that path. The report states that the endpoint and both SSRF sinks remained unchanged through 0.9.3.post20, despite the file having moved.