Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-85673 – SSRF Guard Bypass (Redirect/DNS Rebinding) – LLaMA-Factory OpenAI-Compatible API ≤0

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-85673 is a Server-Side Request Forgery (SSRF) vulnerability in LLaMA-Factory (hiyouga/LlamaFactory), an open-source library for fine-tuning large language models that exposes an OpenAI-compatible API server. The flaw resides in the multimodal media URL handler of that API, where an unauthenticated attacker can bypass an existing SSRF guard by abusing HTTP redirects and DNS rebinding, allowing the server to fetch attacker-chosen internal resources or cloud metadata endpoints. The issue affects all LLaMA-Factory versions through 0.9.5 and carries a High/Critical severity rating (CVSS 8.7).

Technical details

  • Root cause: The API’s check_ssrf_url validation function checks the supplied media URL (e.g., an image_url parameter passed to the OpenAI-compatible chat completions endpoint) once, at the time the request is validated. The actual outbound fetch is then performed via requests.get, which follows HTTP redirects and performs a fresh DNS resolution — neither of which is re-validated against the SSRF allow/deny logic.
  • Trigger conditions: An attacker submits a multimodal chat request containing a media URL (image/video/audio) that initially resolves to, or points to, an allowed/external host but redirects to (or later re-resolves via DNS rebinding to) an internal address, loopback address, or cloud metadata service (e.g., 169.254.169.254).
  • Attack vector: Network-based and does not require authentication — the vulnerable code path is reachable through the OpenAI-compatible API’s multimodal media handling.
  • Impact: Successful exploitation lets an attacker force the LLaMA-Factory server to make arbitrary outbound HTTP requests into internal networks or cloud metadata endpoints, potentially exposing internal services, credentials/tokens from metadata APIs, or enabling further internal reconnaissance and pivoting. The disclosed CVSS impact is limited to confidentiality (no integrity/availability impact indicated in the published vector).
  • This is a bypass of an earlier SSRF fix applied to the same code area (src/llamafactory/api/chat.py and src/llamafactory/api/common.py); the initial guard did not account for post-validation redirects/DNS changes (a time-of-check/time-of-use gap).

Affected software

  • hiyouga/LlamaFactory (PyPI package: llamafactory) — versions 0 through 0.9.5, specifically the OpenAI-compatible API’s multimodal media URL handling.

Severity

  • CVSS v4.0: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CWE-918: Server-Side Request Forgery (SSRF)

Mitigation and recommended actions

  • Immediate: At the time of publication, no confirmed patched release resolving this specific redirect/DNS-rebinding bypass has been identified; the GitHub issue tracking this report notes the prior SSRF fix was incomplete. Security teams should monitor the hiyouga/LlamaFactory repository and upgrade to the latest available release as soon as a fix is published.
  • Network mitigations (until patched):
    • Do not expose the LLaMA-Factory OpenAI-compatible API server directly to untrusted networks or the public internet.
    • Deploy the API behind an egress-filtering proxy or firewall that blocks outbound requests from the application host to private IP ranges (RFC1918), loopback addresses, and cloud metadata endpoints (e.g., 169.254.169.254).
    • Disable or restrict redirect-following at the network/proxy layer for outbound requests initiated by the server.
    • Where feasible, disable or restrict the multimodal (image/video/audio URL) input feature of the chat completions endpoint until a fix is available.
    • Monitor logs for unexpected outbound requests to internal or metadata addresses originating from the LLaMA-Factory service.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge