CVE-2026-63086Active Exploitation

LOWCVSS 6.9 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content. The fetch_image function in router/src/validation.rs performs no validation of private, loopback, link-local, or cloud metadata target addresses, and the reqwest HTTP client follows redirects by default, enabling attackers to bypass scheme checks via redirect chains to reach internal services and cloud instance-metadata endpoints for internal port scanning and credential theft.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://sec.kaitan.id/cves/CVE-2026-63086

Full discourse1 post

Kaitan ID Security@KaitanSecurity92d
Active Exploitation
⚠️ HIGH — CVE-2026-63086 text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compa… CVSS 8.6 ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-63086 #OpenAI #CyberSecurity #InfoSec
Post summary
The post alerts that CVE-2026-63086, a high‑severity SSRF flaw in OpenAI’s text‑generation‑inference 3.3.7, is currently being exploited in the wild, with additional analysis linked.
0001054
87 followersView on X

Explore more

Back to dashboard