{"data":{"id":"8a335510-61be-4912-b933-cb7309e3c058","title":"CVE-2026-85686: ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetch","summary":"ms-swift 4.5.2 has a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't), in its OpenAI-compatible API that handles media files. Attackers without authentication can provide fake image, audio, or video URLs that force the server to request internal services and cloud metadata, potentially exposing sensitive information.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85686","publishedAt":"2026-09-04T15:17:46.360Z","cveId":"CVE-2026-85686","cweIds":["CWE-918"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["ms-swift","OpenAI"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-04T15:17:46.360Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}