OGX exposes an SSRF the project's own guard would have caught.

OGX, formerly Llama Stack, has an OpenAI-compatible POST /v1/responses where MCP tool definitions carry a server_url plus headers and authorization values, fetched server-side with no destination validation. The project ships validate_url_not_private() and applies it to other URL inputs, just not this one. The default starter config runs unauthenticated, so a remote attacker reaches [redacted] and the server forwards attacker-supplied bearer tokens to it (CVE-2026-85666) (NVD).