Description

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument base_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. Endpoint and both sinks unchanged since filing; only the file moved (e277dd1a). Maintainer closed as inapplicable yet the identical unguarded code still ships in 0.9.3.post20. Sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T01:16:56.040Z",
  "pubdate": "2026-09-07T01:16:56.040Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in openagents-org openagents versions up to 0.8.19 and 0.9.3.post20.\nThe vulnerability resides within the test_default_model function located in sdk/src/openagents/sdk/transports/http.py.\nAn unauthenticated remote attacker can manipulate the base_url argument to force the application to make arbitrary HTTP requests to internal or external resources.\nThis flaw enables attackers to bypass network access controls, perform reconnaissance on internal infrastructure, or potentially interact with internal services that are not exposed to the public internet.\nDespite being reported, the maintainers marked the issue as inapplicable; however, the vulnerable, unguarded code remains present in current distributions.\nThe absence of access control checks, specifically the failure to invoke the _require_admin() method used by sibling endpoints, facilitates this unauthorized access.\nThe risk is elevated due to the existence of publicly available exploit code, increasing the likelihood of active exploitation.",
  "technicalDetails": "The vulnerability is a classic Server-Side Request Forgery (SSRF) stemming from improper input validation within the test_default_model function in sdk/src/openagents/sdk/transports/http.py.\nThe root cause is the application's failure to sanitize or validate the user-supplied base_url parameter before utilizing it in an outbound network request.\nThe function is designed to test the connectivity or configuration of a model endpoint, but it fails to implement necessary allow-lists or domain validation for the provided URL.\nAn attacker can supply a crafted base_url pointing to sensitive internal assets (e.g., localhost, internal metadata services such as 169.254.169.254, or private network interfaces) that the host server is permitted to access.\nThe attack flow follows a direct path: the attacker triggers the test_default_model function via an HTTP request, providing a malicious URI in the base_url field. The application, acting as a proxy, performs an outgoing request to the target URI using the internal credentials or network context of the host server.\nBecause the server interprets the attacker-controlled input as a trusted destination, it executes the request and potentially returns sensitive data or error messages that leak internal network topography or information about private services.\nWhile other admin-level endpoints within the library correctly implement _require_admin() to restrict access to authorized users, this specific handler lacks these guards.\nThis inconsistent security posture allows remote, unauthenticated actors to interact with the server's backend transport logic.\nAs the file location has changed in commit e277dd1a, but the functional logic remains identical, the vulnerability persists across versions up to 0.9.3.post20.\nPost-exploitation impact includes the potential for full internal service discovery, unauthorized interaction with internal APIs, and in some cloud-based deployment scenarios, the extraction of temporary instance credentials or configuration data."
}