CVE-2026-85673 Details
Description
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
A server-side request forgery (SSRF) vulnerability has been identified in LLaMA-Factory, specifically within the OpenAI-compatible API's multimodal media URL handler. This vulnerability allows unauthenticated attackers to bypass existing SSRF validation. The issue arises because the 'check_ssrf_url' guard only validates URLs once. Subsequent requests with 'requests.get' follow redirects and re-resolve DNS without re-validation. As a result, attackers can exploit HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
To address this vulnerability, the 'check_ssrf_url' function should be enhanced to re-validate URLs after following redirects. Additionally, the API should not automatically follow redirects and should require authentication by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hiyouga/LlamaFactory/issues/10646 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/hiyouga/LlamaFactory | [email protected] | Vendor |
| https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/chat.py | [email protected] | Source CodeVendor |
| https://github.com/hiyouga/LlamaFactory/blob/v0.9.5/src/llamafactory/api/common.py | [email protected] | Source CodeVendor |
| https://github.com/hiyouga/LlamaFactory/issues/10646 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/llama-factory-ssrf-guard-bypass-via-redirect-and-dns-rebinding | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hiyouga LlamaFactory | <= 0.9.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |