Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-85686 – Unauthenticated SSRF – ms-swift ≤ 4.5.2 OpenAI-Compatible Deployment API

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-85686 is a server-side request forgery (SSRF) vulnerability in ms-swift, an open-source LLM fine-tuning/deployment toolkit maintained by ModelScope, affecting the OpenAI-compatible swift deploy inference API. The API accepts image_url, audio_url, and video_url parameters in multimodal chat completion requests and fetches these URLs server-side without validating the target or restricting redirects, allowing unauthenticated remote attackers to force the server to issue requests to internal network resources and cloud instance metadata services. The flaw is rated HIGH severity (8.7).

Technical details

  • Root cause: The media-loading path (load_file in swift/template/vision_utils.py, invoked via load_image/remove_messages_media in swift/template/base.py and swift/template/template_inputs.py) fetches any URL beginning with http using a simple session.get(path) call, with no validation of the destination IP/hostname and no restriction on HTTP redirects.
  • Trigger conditions: The swift deploy server binds to 0.0.0.0 and runs with no authentication (api_key=None) by default, so any network-reachable client can submit a /v1/chat/completions request containing a crafted image_url, audio_url, or video_url.
  • Attack vector: Network, no privileges or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N). An attacker can point the media URL at loopback addresses, RFC1918 private ranges, link-local addresses, or cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), and can also use HTTP redirects to bypass any external allowlisting since redirects are followed without re-validation.
  • Impact: Disclosure of internal service responses and cloud instance metadata (which can include temporary cloud credentials), and the ability to probe/interact with internal-only network services from the server’s network position. The vulnerability primarily impacts confidentiality.

Affected software

  • Product: ms-swift (pkg:pypi/ms-swift), maintained by ModelScope
  • Affected versions: All versions up to and including 4.5.2

Severity

  • CVSS v3.1 Base Score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVSS v4.0 Base Score: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • CWE-918: Server-Side Request Forgery (SSRF)

Mitigation and recommended actions

  • Immediate: No official patched release is currently available. A fix (_assert_media_url_allowed(), which rejects requests resolving to private, loopback, link-local, reserved, multicast, or unspecified IP ranges, blocks non-HTTP(S) schemes, and re-validates each hop of a redirect) has been proposed upstream but was not merged as of this writing, pending a broader refactor of the multimodal loading path. Security teams should track the upstream repository for a released fix and upgrade as soon as one ships.
  • If no patch is available:
    • Do not expose the swift deploy OpenAI-compatible API directly to untrusted networks; place it behind an authenticating reverse proxy or API gateway and avoid binding to 0.0.0.0 in untrusted environments.
    • Enable authentication on the deployment server (do not run with api_key=None) and restrict inbound access via network ACLs/firewalls to trusted clients only.
    • Block or filter outbound requests from the host running ms-swift to loopback, private/RFC1918, link-local (including 169.254.169.254), and other reserved IP ranges at the network/egress-firewall layer.
    • Disable or tightly control cloud instance metadata service access (e.g., enforce IMDSv2 with hop-limit restrictions on AWS, or equivalent metadata protections on other cloud providers) for hosts running this service.
    • Monitor egress traffic and logs from ms-swift deployment hosts for anomalous requests to internal IP ranges or metadata endpoints.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge