OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.

OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.

markdown: python-markdown: Denial of Service via inefficient inline link parsing undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives @fastify/static: @fastify/static: Information disclosure via route guard bypass fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority undici: undici: Denial of Service via unrequested WebSocket subprotocol extract-zip: extract-zip: Arbitrary file write via symlink in archive encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server systeminformation: systeminformation: Arbitrary Command Execution via OS Command Injection mlflow: mlflow: Arbitrary file write via FileStore path traversal mcp: mcp: Denial of Service via session memory exhaustion in streamable HTTP servers nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names accelerate: Hugging Face Accelerate: Path Traversal and Denial of Service via weight_map brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Ser…