Description

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-06T13:17:10.963Z",
  "pubdate": "2026-09-06T13:17:10.963Z",
  "executiveSummary": "OpenMAIC versions prior to 1.0.1 contain a Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation in non-production builds.\nThe vulnerability allows unauthenticated remote attackers to manipulate the application into performing arbitrary HTTP requests against internal cloud metadata services.\nBy controlling the base URL via specific request headers or parameters, an attacker can exfiltrate sensitive information, including cloud instance credentials, identity tokens, and environmental configurations.\nThe risk is critical for deployments running within cloud environments (such as AWS, GCP, or Azure), as the metadata service is typically accessible via a local link-local address (e.g., 169.254.169.254).\nExploitation requires no authentication, allowing any actor with network access to the affected endpoint to bypass security controls and potentially achieve full compromise of the cloud instance's identity and privileges.",
  "technicalDetails": "The vulnerability originates from a flaw in the application's configuration handling, where server-side request forgery protections are explicitly bypassed or disabled within non-production builds. This design choice fails to enforce necessary input validation on user-supplied URL components.\nAttackers can leverage this bypass by manipulating the x-base-url header or the baseUrl query parameter. When the application processes these inputs, it fails to sanitize or validate the target destination, allowing the underlying request-making component to target arbitrary hosts, including internal network infrastructure that is otherwise unreachable from the public internet.\nThe attack flow proceeds as follows: First, the attacker identifies a target OpenMAIC instance running a vulnerable version. Second, the attacker crafts a malicious HTTP request, injecting a target URL pointing to the cloud provider's metadata service (e.g., http://169.254.169.254/latest/meta-data/) into the x-base-url header. Third, the OpenMAIC server receives this request and, due to the lack of validation, executes a backend request to the metadata service. Finally, the server reflects the response from the metadata service back to the attacker, or uses the data to perform subsequent actions.\nThe primary impact of this SSRF is the unauthorized retrieval of cloud instance identity credentials. In many cloud environments, accessing the metadata service permits an attacker to obtain temporary security credentials associated with the instance's IAM role. With these credentials, an attacker can impersonate the instance, escalate privileges within the cloud environment, or access further resources permitted by the instance's attached IAM policies.\nThe vulnerability is restricted to versions prior to 1.0.1 and specifically affects configurations where non-production build settings are active. The exposure is amplified in cloud-hosted environments where internal metadata services are reachable via the application server's network stack without further authentication or restrictive firewall rules."
}