CVE-2026-26286 in SillyTavern
Summary
by MITRE • 02/19/2026
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.16.0, a Server-Side Request Forgery (SSRF) vulnerability in the asset download endpoint allows authenticated users to make arbitrary HTTP requests from the server and read the full response body, enabling access to internal services, cloud metadata, and private network resources. The vulnerability has been patched in the version 1.16.0 by introducing a whitelist domain check for asset download requests. It can be reviewed and customized by editing the `whitelistImportDomains` array in the `config.yaml` file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/22/2026
The vulnerability identified as CVE-2026-26286 affects SillyTavern, a locally installed user interface designed for interacting with various artificial intelligence models including large language models, image generation engines, and text-to-speech systems. This application serves as a bridge between users and these AI services, making it a critical component in AI development and experimentation environments. The vulnerability exists within the asset download endpoint functionality, which is essential for retrieving external resources and models needed for the application's operation. Prior to version 1.16.0, this endpoint failed to properly validate or restrict the domains to which HTTP requests could be made, creating a significant security risk for users who might unknowingly expose their internal infrastructure to unauthorized access.
The technical flaw manifests as a Server-Side Request Forgery vulnerability that allows authenticated users to manipulate the asset download functionality to make arbitrary HTTP requests from the server itself. This occurs because the application does not properly validate the destination URLs for asset downloads, enabling attackers to specify any valid HTTP endpoint. The vulnerability is particularly dangerous because it operates at the server level, meaning that authenticated users can leverage this weakness to access internal services that would normally be protected by network segmentation and firewalls. The full response body of these requests is returned to the attacker, providing complete access to any information exposed by the target services. This includes sensitive data from internal applications, cloud metadata services, and private network resources that should remain isolated from external access. The vulnerability represents a classic SSRF implementation where the application acts as an intermediary, making requests on behalf of the attacker while bypassing normal network restrictions.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can potentially enable further attacks within the network environment. An authenticated attacker could use this vulnerability to enumerate internal services, access cloud instance metadata that often contains sensitive credentials and configuration data, or probe for additional vulnerabilities in internal systems. The attack vector is particularly concerning because it requires only authentication to the SillyTavern application, which typically involves a user account with basic privileges. This means that even users with limited access rights could potentially escalate their privileges by accessing internal resources that contain more sensitive information or system controls. The vulnerability essentially creates a backdoor through which internal network resources become accessible to anyone who can authenticate to the application, effectively bypassing traditional network security controls.
The remediation implemented in version 1.16.0 addresses this vulnerability through the introduction of a domain whitelist mechanism for asset download requests. This approach aligns with the principle of least privilege and follows established security practices for preventing SSRF attacks. The solution requires administrators to explicitly define which domains are allowed to be accessed through the asset download functionality by editing the `whitelistImportDomains` array in the `config.yaml` file. This configuration-based approach allows for fine-grained control over external resource access while maintaining the application's core functionality. The mitigation strategy is consistent with the CWE-918 weakness classification, which specifically addresses server-side request forgery vulnerabilities and recommends input validation and domain whitelisting as primary defense mechanisms. Organizations implementing SillyTavern should review their configuration files to ensure that only trusted domains are included in the whitelist, and should regularly audit these settings to prevent accidental inclusion of malicious domains. The fix also aligns with ATT&CK technique T1071.004, which covers application layer protocol: DNS, as it prevents unauthorized DNS resolution and network access through the application's HTTP request handling mechanisms.