CVE-2026-85686: ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetch
Summary
ms-swift 4.5.2 has a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't), in its OpenAI-compatible API that handles media files. Attackers without authentication can provide fake image, audio, or video URLs that force the server to request internal services and cloud metadata, potentially exposing sensitive information.
Vulnerability Details
7.5(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
network
low
none
none
September 4, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-85686
First tracked: September 4, 2026 at 02:08 PM
Classified by LLM (prompt v3) · confidence: 92%