huggingface text-generation-inference up to 3.3.7 router/src/validation.rs fetch_image image_url server-side request forgery

Summaryinfo

A vulnerability has been found in huggingface text-generation-inference up to 3.3.7 and classified as problematic. Affected by this vulnerability is the function fetch_image of the file router/src/validation.rs of the component OpenAI-Compatible Multimodal Chat Completions Endpoint. Performing a manipulation of the argument image_url results in server-side request forgery. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2026-63086. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in huggingface text-generation-inference up to 3.3.7. It has been classified as problematic. This affects the function fetch_image of the file router/src/validation.rs of the component OpenAI-Compatible Multimodal Chat Completions Endpoint. The manipulation of the argument image_url with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality. The summary by CVE is:

text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content. The fetch_image function in router/src/validation.rs performs no validation of private, loopback, link-local, or cloud metadata target addresses, and the reqwest HTTP client follows redirects by default, enabling attackers to bypass scheme checks via redirect chains to reach internal services and cloud instance-metadata endpoints for internal port scanning and credential theft.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-63086 since 07/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-44953). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• huggingface

Name

• text-generation-inference

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion