CVE-2026-85686 in ms-swift
Summary
by MITRE • 09/04/2026
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The ms-swift version 4.5.2 contains a critical Server-Side Request Forgery vulnerability within its OpenAI-compatible API deployment interface. This flaw arises from insufficient validation of user-supplied input when processing multimodal media parameters, specifically image_url, audio_url, and video_url fields. The application functions by accepting these URLs to fetch external content for model inference or processing but fails to implement adequate safeguards against maliciously crafted endpoints. Consequently, an unauthenticated attacker can manipulate the request payload to direct the server to retrieve resources from arbitrary destinations rather than legitimate media sources. This lack of input sanitization allows the vulnerability to be exploited without any form of authentication, significantly lowering the barrier for entry and increasing the potential attack surface available to threat actors targeting this service.
The technical mechanism behind this exploitation involves injecting malicious URLs that resolve to internal network addresses or cloud provider metadata endpoints. By supplying a URL pointing to an internal IP address, such as those used by database servers, application backends, or other microservices within the same virtual private cloud, attackers can force the server to make requests on their behalf. Furthermore, because many modern infrastructure environments expose instance metadata services at well-known addresses like 169.254.169.254 for AWS or similar endpoints in Azure and GCP, this vulnerability enables access to sensitive configuration data. Attackers can leverage these internal fetches to extract cloud credentials, security tokens, network topology details, and other confidential information that is typically restricted from external public internet access but accessible internally by the application server itself.
The operational impact of this vulnerability extends beyond simple data exfiltration. The ability to interact with internal services allows attackers to perform port scanning within the private network, map out service dependencies, and potentially pivot further into the infrastructure if those internal services have their own vulnerabilities. In cloud environments, accessing metadata endpoints can lead to full account compromise by stealing temporary security credentials that grant access to storage buckets, compute instances, or managed database services. This effectively bypasses perimeter defenses since the traffic originates from a trusted application server, making it difficult for traditional network intrusion detection systems to identify as malicious activity based on source IP alone. The severity is compounded by the fact that multimodal APIs are often exposed publicly to facilitate user interaction with AI models, providing a direct vector for exploitation from anywhere on the internet.
This vulnerability aligns with CWE-918, which classifies Server-Side Request Forgery as an improper restriction of XML external entity or URL references used in server-side processing. It also maps directly to MITRE ATT&CK technique T1504.003, specifically Cloud Infrastructure Discovery via Metadata Endpoints, and potentially T1071.001 for Application Layer Protocol abuse if the fetched data is exfiltrated through standard web channels. To mitigate this risk, immediate remediation should involve implementing strict allow-listing of permitted URL domains or IP ranges that the application is authorized to access. Developers must also enforce redirect filtering to prevent attackers from bypassing initial restrictions by chaining redirects to internal targets. Additionally, integrating a proxy layer with robust validation logic and ensuring that the server does not have direct network access to sensitive metadata endpoints through security group rules or firewall policies are essential steps in reducing the blast radius of this vulnerability until a patched version is deployed.