Vulnerability  ·  2026-09-08

OpenMAIC unauthenticated SSRF to cloud metadata service via fail-open middleware and environment-gated URL validation bypass

VulnerabilityHigh impactGlobalCVE-2026-86259
THU-MAIC published a GitHub Security Advisory (GHSA-9m7h-vh2h-rc3w) on 2026-09-06 describing a two-leg vulnerability chain in the OpenMAIC open-source multi-agent classroom platform: authentication middleware fails open when ACCESS_CODE is unset, and SSRF URL validation is skipped entirely when the app is not running with NODE_ENV=production. Combined, these allow an unauthenticated attacker to submit crafted base-URL parameters that cause the server to fetch cloud instance metadata endpoints.
Because OpenMAIC is an agentic AI platform that itself proxies outbound calls to image/video generation and document-parsing services, the SSRF sink reaches the cloud metadata service directly, giving an attacker a path to IAM credentials and any downstream cloud resources accessible to that role — a full cloud-pivot risk from an unauthenticated web request against an AI agent platform.
An unauthenticated remote attacker exploits fail-open authentication middleware (default unset ACCESS_CODE) combined with an environment-gated SSRF validation bypass (x-base-url or baseUrl parameter bypasses validation when NODE_ENV is not 'production') to force the server to make outbound requests to the cloud instance metadata service, potentially retrieving IAM credentials available to the deployment's role for further pivoting.
OpenMAIC (THU-MAIC) versions ≤ 1.0.0
Upgrade to OpenMAIC 1.0.1; set an ACCESS_CODE so authentication fails closed; apply URL validation unconditionally regardless of NODE_ENV; restrict network egress and metadata service access; rotate any potentially exposed cloud credentials.
GitHub Security Advisory GHSA-9m7h-vh2h-rc3wVulnCheck Advisory - OpenMAIC SSRF
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →