# CVE-2026-8768: Vercel AI SSRF via HTTP redirect in provider-utils

Source: https://junglewise.ai/threats/cve-2026-8768-vercel-ai-ssrf-via-http-redirect-in-provider-utils  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8768 · Severity: high · CVSS 7.3 · Published 2026-05-17

A vulnerability exists in the Vercel AI SDK, a toolkit used by developers to build AI-powered applications. The software fails to properly restrict network requests when downloading external content like images, allowing an attacker to force the server to connect to internal systems that should be private. This could allow an attacker to interact with internal databases, cloud metadata services, or other protected infrastructure, potentially leading to unauthorized actions or service disruptions.

Technologies: [Vercel AI SDK](https://junglewise.ai/threats/technologies/ai-sdk). Vendors: [Vercel](https://junglewise.ai/threats/vendors/vercel).

## Quick answers

**Is CVE-2026-8768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8768 being exploited in the wild.

**How severe is CVE-2026-8768?** High severity, with a CVSS score of 7.3, published 17 May 2026.

**Which products and versions are affected?** Vercel AI SDK up to 3.0.97; Vercel AI SDK Provider Utils up to 3.0.97.

**Is there a fix for CVE-2026-8768?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8768?** Check whether you run Vercel AI SDK or Vercel AI SDK Provider Utils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Blind Server-Side Request Forgery (SSRF) vulnerability exists in the `validateDownloadUrl` function within `packages/provider-utils/src/download-blob.ts`. The root cause is a Time-of-Check to Time-of-Use (TOCTOU) flaw where the SDK validates an initial URL but uses the native `fetch()` API with the default `redirect: 'follow'` behavior. An attacker can provide a benign-looking URL that passes initial validation but redirects to a restricted internal IP (e.g., 127.0.0.1 or 169.254.169.254). Although the SDK performs a post-flight check on the redirected URL and prevents the attacker from reading the response, the HTTP GET request is successfully executed against the internal target before the check occurs. This allows unauthenticated remote attackers to trigger internal REST actions or perform port scanning.

## Affected products

- Vercel ai-sdk/provider-utils up to 3.0.97
- Vercel ai up to 3.0.97

## Timeline

- 2026-04-04: disclosed: Vulnerability details shared via GitHub Gist by researcher YLChen-007
- 2026-05-17: advisory: CVE-2026-8768 published

## References

- [https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71](https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71)
- [https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f](https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f)
- [https://vuldb.com/submit/811404](https://vuldb.com/submit/811404)
- [https://vuldb.com/submit/811405](https://vuldb.com/submit/811405)
- [https://vuldb.com/vuln/364393](https://vuldb.com/vuln/364393)
- [https://vuldb.com/vuln/364393/cti](https://vuldb.com/vuln/364393/cti)

## Related threats

- [Vercel AI SDK denial of service in provider-utils response handler](https://junglewise.ai/threats/cve-2026-8769-vercel-ai-sdk-denial-of-service-in-provider-utils-response-handler)
- [Vercel AI OS command injection in GitHub Actions workflow](https://junglewise.ai/threats/cve-2026-8767-vercel-ai-os-command-injection-in-github-actions-workflow)
- [Vercel AI SDK filetype whitelist bypass in file upload](https://junglewise.ai/threats/cve-2025-48985-vercel-ai-sdk-filetype-whitelist-bypass-in-file-upload)