Vibe Coding
CVE-2026-85666: OGX's MCP tool definitions accept a server_url the SSRF guard never checks
OGX, formerly Llama Stack, exposes an OpenAI-compatible POST /v1/responses where MCP tool definitions carry a server_url plus headers and authorization values, fetched server-side with no destination validation. The project's own validate_url_not_private() guard is applied to other URL inputs but not this one. The default starter config runs unauthenticated, so a remote attacker can reach [redacted] and have the server forward attacker-supplied bearer tokens to it.
Source
↳ Follow the thread