Intelligence
Join the waitlist
AEV-2026-0027

OGX Responses API forwards a caller supplied MCP server_url with no destination check (CVE-2026-85666)

OGX's OpenAI compatible POST /v1/responses endpoint accepts a caller supplied MCP tool definition whose server_url reaches list_mcp_tools, and an MCP session initialization connection, with only a non empty check applied. The same codebase's validate_url_not_private helper already gates two sibling caller controlled URL inputs but was never connected to this path. Formally assigned CVE-2026-85666 on 4 September 2026, with two proposed fixes, pull requests 6390 and 6291, both open and unmerged as of this entry; 6291 additionally distinguishes a caller supplied MCP endpoint from an administrator configured connector or toolgroup endpoint.

AESS 7.7 highConfirmedStatus: publishedEvent: 4 September 2026Environment BoundariesExecution AuthorityAgent Identity

Affected

Organisation
ogx-ai project (OGX, formerly Llama Stack)
Product
OGX
Component
_process_mcp_tool in the Responses API's streaming module, reaching list_mcp_tools and mcp.py's MCP session construction
Versions
Through version 1.3.1, confirmed at commit fbe8e0fb0fe99640327bf49b8156b65cd7fc8c19; no patched version found
Configurations
OGX's OpenAI compatible POST /v1/responses endpoint reachable by a caller, MCP tool support enabled; The tested default starter configuration, which carries no auth: block and leaves the endpoint reachable with no Authorization header

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
A caller invokes the Responses API with an MCP tool definition naming the MCP server it should list tools from
Agent
OGX's own server process, through _process_mcp_tool and the MCP client session mcp.py constructs
Delegating actor
The operator who deploys OGX and decides whether to configure an auth: block
Action
Opened an MCP session, at Streamable HTTP or SSE session initialization, against a caller named server_url with no destination check applied
Target resource
Whatever loopback, link local, private network or, where reachable from the deployment, cloud metadata destination the caller names as server_url
Environment
Wherever the operator deploys the OGX server process
Credentials used
None of OGX's own; a caller supplied value in the dedicated authorization parameter is forwarded as an Authorization Bearer header to the caller named destination
Privileges available
The OGX server process's own network reachability from its deployment location
Authority presented
A well formed MCP tool definition naming server_url, under the tested starter configuration presented with no Authorization header at all
Authority required
Authorization for the specific destination the caller directed the server's MCP session to
Applicable policy
The validate_url_not_private helper, already applied to two sibling caller controlled URL inputs in the same codebase; not applied to this path
Approval mechanism
none
Required approver
unknown
Independent approval
no
Action binding
The tool definition's authority bound to naming an MCP server; the destination itself was not independently checked before the server's own session initialization connected to it
Sequence context
The connection occurs at MCP session initialization, during tool discovery, before any tool the session might expose is listed or called

Impact

Consequence
The OGX server process's own outbound connection directed at a caller named destination, demonstrated against a loopback listener; a caller supplied Authorization Bearer token also reaches that destination
Reach
organisational
Reversibility
unknown
Detectability
unknown
Propagation
Not established as observed against a real internal service or cloud metadata endpoint; the reproduction available to this entry used a loopback listener the reporter deployed
Recovery
No patched version found. Two open, unmerged pull requests propose the corrective. Pull request 6390 adds validate_url_not_private(mcp_tool.server_url) before list_mcp_tools opens a connection; it is community reviewed but not maintainer approved. Pull request 6291, an independently opened draft, proposes the same check plus a scheme restriction, and states an administrator configured connector or toolgroup endpoint remains outside it. Neither has merged as of this entry, and this session's re-check of the current default branch confirms _process_mcp_tool still applies only the original non empty check.

Evidence

Primary sources

Supporting sources

Reproduction status
Vendor path disclosed by an independent reporter, not yet patched. Reporter demonstrated a server side connection against a self deployed loopback listener. Moona Intelligence did not itself run OGX or reproduce the connection; this session read the affected source directly at the commit the primary issue names, confirming the absent destination check, the MCP session construction and the two sibling paths that already call validate_url_not_private.
Evidence state
Confirmed

Known unknowns

  • Whether this has been exploited against a real OGX deployment.
  • What share of OGX deployments run without an auth: block versus a custom deployment carrying one.
  • Whether a cloud metadata endpoint has ever actually been reached through this path, as distinct from the loopback listener the reporter's own reproduction used.
  • Whether pull request 6390 or pull request 6291 will merge as currently written or be revised first, and whether a future revision adds redirect revalidation or binds the connection to the address validate_url_not_private resolves.
  • Whether pull request 6291's own stated separate treatment of administrator configured connector and toolgroup endpoints holds up against that resolution path's own source, which this entry has not itself read.

Limitations

  • This session's direct fetch of the CVE Program's own record at cve.org was blocked by this session's network egress policy; CVE metadata is corroborated through the GitHub Advisory Database rather than read directly from the Program's own record.
  • The GitHub issue and the pull request were retrieved through this session's automated page fetch and summarization tool rather than read as raw markup, though both accounts are independently confirmed against this session's own direct read of the affected source at the commit the issue names.

Claim provenance

  • verified
    GitHub's Security Advisory Database, read directly, assigns CVE-2026-85666, rates it CVSS 4.0 base 8.7 High, and classifies it CWE-918, Server Side Request Forgery, against OGX through version 1.3.1 at commit fbe8e0fb0fe99640327bf49b8156b65cd7fc8c19.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • verified
    This session read the affected source directly at the commit the primary issue names, confirming _process_mcp_tool applies only a non empty check to server_url before list_mcp_tools opens an MCP session against it through streamablehttp_client or sse_client, both invoked with the caller supplied endpoint unchanged.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • verified
    This session read validate_url_not_private directly and confirmed it already gates two sibling caller controlled URL inputs, an image content fetch and a RAG document fetch, in the same codebase, establishing that the missing check on the MCP tool path is an omission from an existing, working policy rather than an absent one.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • independent-reporting
    The primary issue, filed by a reporter independent of the OGX maintainers, states the private report chronology, the tested starter configuration's unauthenticated GET /v1/health behavior, and a loopback reproduction demonstrating the server side connection effect.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • verified
    The open pull request, read directly, proposes adding validate_url_not_private(mcp_tool.server_url) to _process_mcp_tool before list_mcp_tools is called, and adds tests for a link local address, a loopback address and an allowed public address. It is not merged.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • verified
    A second, independently opened pull request, read directly, proposes the same private address check on the same caller supplied server_url plus a scheme restriction, as a draft rather than a submission ready for review, and states, quoted directly, that admin configured connector and toolgroup private MCP endpoints remain allowed and connector resolved Responses URLs are trusted. It is not merged, and this entry did not independently read the connector or toolgroup resolution path that statement describes.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.
  • verified
    Re-checked directly on 6 September 2026: the current default branch still applies only the original non empty check to server_url, with no call to validate_url_not_private in _process_mcp_tool; issue 6287 remains open; and 1.3.1, the affected release, remains OGX's latest published release, so the affected version scope this entry states is unchanged.
    The Caller Chose the MCP Server. OGX Treated That Choice as Network Authority.