CVE-2026-6111: 
Python vulnerability analysis and mitigation

CVE-2026-6111 is a Server-Side Request Forgery (SSRF) vulnerability in FoundationAgents MetaGPT affecting the decode_image() function in metagpt/utils/common.py. The vulnerability was reported via a GitHub issue on February 4, 2026, and publicly disclosed on April 12, 2026. It affects MetaGPT versions up to and including 0.8.2 (pip package), with no patched version yet officially released by the maintainers. The CVSS v3.1 base score is 6.5 (Medium), while the CVSS v4.0 base score is 2.1 (Low) (Github Advisory, Feedly).

The root cause is improper input validation (CWE-918: SSRF) in the decode_image() function located at metagpt/utils/common.py (lines 859–870). The function checks only whether the img_url_or_b64 argument starts with "http" before issuing an unvalidated requests.get() call, with no IP address filtering, hostname resolution checks, or allowlist enforcement. This is classified as a Semi-Blind SSRF: the HTTP response is passed through PIL.Image.open(), which filters non-image content and prevents direct data exfiltration, but timing-based inference, error-based inference, and DNS exfiltration remain viable. Attack vectors include LLM prompt injection (causing the LLM to generate malicious image URLs) and API response manipulation (e.g., MITM on OpenAI API responses injecting internal URLs) (Github Issue #1934, Github Advisory).

A low-privileged, remote attacker can force the MetaGPT server to issue arbitrary HTTP requests to internal or external destinations, enabling internal network reconnaissance (port scanning via timing analysis), access to cloud instance metadata endpoints (AWS 169.254.169.254, Azure, GCP), and data exfiltration via DNS queries. While direct response content reading is limited by the Image.open() filter, attackers can still trigger actions on internal services (e.g., cache flushes, webhooks) and potentially harvest cloud credentials from metadata APIs. Integrity and availability impacts are low; the primary risk is confidentiality of internal network topology and cloud credentials (Github Issue #1934, Github Advisory).

A public vulnerability scanner (PoC) written in Python has been released on GitHub, designed to detect the presence of CVE-2026-6111 on target instances; it is classified as a detection tool rather than a full exploit (Feedly). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.043% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify MetaGPT deployments (versions ≤ 0.8.2) exposed via API or web interface using network scanning tools or by reviewing public-facing AI agent platforms.
2. Identify injection point: Locate functionality that invokes decode_image() — primarily image generation workflows that pass URLs from LLM responses or API outputs to the function (e.g., via metagpt/provider/openai_api.py).
3. Craft malicious URL: Prepare a URL targeting an internal resource, such as http://127.0.0.1:<port>/internal/admin/secret for localhost services, or http://169.254.169.254/latest/meta-data/iam/security-credentials/ for AWS metadata.
4. Inject the URL: Deliver the malicious URL via LLM prompt injection (crafting input that causes the LLM to output the attacker-controlled URL as an image URL) or by intercepting/manipulating the API response to inject the URL.
5. Trigger SSRF: The decode_image() function executes requests.get(img_url_or_b64) without validation, causing the server to fetch the attacker-specified URL.
6. Infer results: Use timing differences to determine port open/closed status, monitor attacker-controlled DNS servers for exfiltrated data, or analyze error messages for partial response content (Github Issue #1934).

• Network: Outbound HTTP requests from the MetaGPT server process to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unusual DNS queries from the MetaGPT host to external attacker-controlled domains containing encoded data.
• Logs: Application logs showing requests.get() calls to non-public or internal URLs within the decode_image() function; PIL.Image.open() exceptions triggered by non-image responses from internal endpoints.
• Process: Unexpected outbound network connections initiated by the Python process running MetaGPT to internal network hosts or metadata services (Github Issue #1934).

No official patched release has been published by the MetaGPT maintainers as of the advisory date; the GitHub Advisory Database lists all versions ≤ 0.8.2 as affected with no patched version available (Github Advisory). A community-contributed fix is available in PR #1941, which adds an is_safe_url() function that validates URL scheme, resolves hostnames to IPs, and blocks requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) and IPv6 localhost (Github PR #1941). As interim workarounds: apply network-level egress controls to restrict outbound HTTP from the MetaGPT service to authorized destinations only; avoid exposing MetaGPT APIs to untrusted users; and manually patch metagpt/utils/common.py using the logic from PR #1941.

The vulnerability was first reported by researcher YLChen-007 via a detailed GitHub issue on February 4, 2026, with a thorough technical breakdown including PoC code and remediation options (Github Issue #1934). A community contributor (paipeline) submitted PR #1941 with a fix on February 11, 2026, but the PR remained unmerged as of the advisory publication date, with the project maintainers not yet responding (Github PR #1941). The vulnerability received automated coverage from CVE aggregators and threat intelligence feeds, with a Bluesky post noted in tracking data, but no significant mainstream media coverage or vendor statement has been issued.