Executive brief
OGX is an open-source platform for building and deploying AI applications. The platform's default configuration runs without authentication and accepts tool definitions that specify a server URL. An unauthenticated remote attacker can exploit this to make the OGX server open connections to arbitrary internal addresses (including cloud metadata endpoints) and forward attacker-controlled headers and tokens, potentially exposing sensitive infrastructure credentials and internal service data.
Technical details
OGX's POST /v1/responses endpoint accepts MCP tool definitions containing a server_url parameter that is fetched server-side without destination validation. The vulnerable code path fails to apply the validate_url_not_private() guard that is used for other URL inputs, allowing attackers to bypass restrictions on internal address targeting. The attack requires no authentication on default configurations. An attacker can cause the server to open connections to arbitrary destinations (including cloud metadata endpoints like http://169.254.169.254/) and forward custom headers and bearer tokens to those destinations, potentially exfiltrating cloud credentials or accessing internal services. Patches addressing the validation gap are expected from the vendor.
Affected products
- OGX OGX up to and including v1.3.1 (affected at commit fbe8e0f)
Timeline
- 2026-09-04: disclosed