CVE-2026-85666

Name of the Vulnerable Software and Affected Versions OGX (formerly Llama Stack) versions up to commit fbe8e0f

Description An unauthenticated server-side request forgery (SSRF) exists in the OpenAI-compatible 'POST /v1/responses' endpoint. The issue occurs because MCP tool definitions accept a server url parameter that is fetched server-side without destination validation, bypassing the validate url not private() guard used for other inputs. A remote unauthenticated attacker can use this to force the server to open connections to arbitrary internal addresses, such as cloud metadata endpoints (e.g., http://169.254.169.254/), and forward attacker-supplied headers and bearer tokens to those destinations.

Recommendations Update OGX (formerly Llama Stack) to a version released after commit fbe8e0f. Restrict access to the 'POST /v1/responses' endpoint to prevent unauthenticated remote access.