What happened
THU-MAIC published a GitHub Security Advisory (GHSA-9m7h-vh2h-rc3w) on 2026-09-06 describing a two-leg vulnerability chain in the OpenMAIC open-source multi-agent classroom platform: authentication middleware fails open when ACCESS_CODE is unset, and SSRF URL validation is skipped entirely when the app is not running with NODE_ENV=production. Combined, these allow an unauthenticated attacker to submit crafted base-URL parameters that cause the server to fetch cloud instance metadata endpoints.
Why it matters
Because OpenMAIC is an agentic AI platform that itself proxies outbound calls to image/video generation and document-parsing services, the SSRF sink reaches the cloud metadata service directly, giving an attacker a path to IAM credentials and any downstream cloud resources accessible to that role — a full cloud-pivot risk from an unauthenticated web request against an AI agent platform.
Attack vector
An unauthenticated remote attacker exploits fail-open authentication middleware (default unset ACCESS_CODE) combined with an environment-gated SSRF validation bypass (x-base-url or baseUrl parameter bypasses validation when NODE_ENV is not 'production') to force the server to make outbound requests to the cloud instance metadata service, potentially retrieving IAM credentials available to the deployment's role for further pivoting.
Affected systems
OpenMAIC (THU-MAIC) versions ≤ 1.0.0
Mitigation
Upgrade to OpenMAIC 1.0.1; set an ACCESS_CODE so authentication fails closed; apply URL validation unconditionally regardless of NODE_ENV; restrict network egress and metadata service access; rotate any potentially exposed cloud credentials.