CVE-2026-6605: 
Python vulnerability analysis and mitigation

CVE-2026-6605 is a Server-Side Request Forgery (SSRF) vulnerability in modelscope AgentScope, a multi-agent framework for LLM applications. The flaw resides in the _get_bytes_from_web_url() function within src/agentscope/_utils/_common.py, which fetches user-supplied URLs without any validation. All versions up to and including 1.0.18 are affected. The vulnerability was disclosed on April 20, 2026, with a public proof-of-concept published prior to vendor response. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, VulDB).

The root cause is CWE-918 (Server-Side Request Forgery): the _get_bytes_from_web_url() function calls requests.get(url) directly on attacker-controlled URLs with no URL validation — no private IP blocking, no scheme restriction, and no hostname allowlisting. This function is invoked from at least 8 locations across formatters (OpenAI, Ollama, Gemini) and realtime models when processing multimodal content blocks (audio, image, video) in Msg objects. Critically, this is a full (non-blind) SSRF: the fetched response content is base64-encoded and returned directly in the HTTP API response, enabling direct data exfiltration. An additional independent vulnerable call exists in _to_openai_audio_data() in src/agentscope/formatter/_openai_formatter.py. The .wav extension check in the OpenAI formatter is trivially bypassed by appending .wav to any target URL path (PoC Gist, GitHub Advisory).

Successful exploitation enables full (non-blind) SSRF, where the complete response body from internal or cloud metadata requests is returned to the attacker base64-encoded in the API response. An attacker can steal cloud IAM credentials (AWS, GCP, Azure) by targeting instance metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/), exfiltrate data from internal APIs and admin panels, and conduct internal network reconnaissance by probing hosts and ports. The wide attack surface — spanning OpenAI, Ollama, and Gemini formatters — means any AgentScope deployment accepting user-supplied multimodal content is affected, with potential for lateral movement into cloud infrastructure (PoC Gist).

A public proof-of-concept was published by researcher YLChen-007 on GitHub Gist prior to vendor response, and the exploit has been released to the public (PoC Gist). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable remotely. The EPSS score is approximately 0.054% (17th percentile), indicating currently low observed exploitation probability. No evidence of active in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog. The vendor did not respond to early disclosure (GitHub Advisory, VulDB).

1. Reconnaissance: Identify internet-facing AgentScope deployments (versions ≤ 1.0.18) that accept multimodal message inputs and format them for LLM APIs (OpenAI, Ollama, or Gemini formatters).
2. Craft malicious payload: Construct a Msg-compatible JSON payload containing a multimodal content block (audio, image, or video) with a url source pointing to an internal target, such as the AWS metadata endpoint. Append .wav to bypass the extension check in the OpenAI formatter:

{
  "name": "user",
  "role": "user",
  "content": [
    {"type": "text", "text": "Transcribe this audio"},
    {"type": "audio", "source": {
      "type": "url",
      "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/role.wav"
    }}
  ]
}

3. Send the request: Submit the crafted payload via HTTP POST to the AgentScope API endpoint that processes multimodal messages.
4. Receive exfiltrated data: The server fetches the internal URL via requests.get(), base64-encodes the response, and returns it in the API response body.
5. Decode the response: Extract and decode the base64-encoded content from the response to obtain the stolen credentials or internal service data:

import base64
stolen = base64.b64decode(response_json["formatted_messages"][0]["content"][1]["input_audio"]["data"])
# stolen = '{"AccessKeyId": "AKIAIOSFODNN7EXAMPLE", "SecretAccessKey": "wJalrXU..."}'

6. Lateral movement: Use exfiltrated cloud credentials to authenticate to cloud APIs and pivot to additional internal resources (PoC Gist).

• Network: Outbound HTTP requests from the AgentScope server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints; unusual outbound connections to unexpected internal hosts and ports initiated by the AgentScope service.
• Logs: Web server access logs showing POST requests to AgentScope API endpoints with multimodal content blocks containing url fields pointing to internal addresses; application logs showing requests.get() calls to non-public URLs from _get_bytes_from_web_url() or _to_openai_audio_data().
• File System: No specific file artifacts expected, but review for any credential files or configuration dumps written to disk by post-exploitation activity.
• Process: Unexpected network connections initiated by the Python process running AgentScope to internal network segments or cloud metadata services (PoC Gist, GitHub Advisory).

The GitHub Advisory notes no patched version is currently listed, but Feedly intelligence indicates users should upgrade to a version beyond 1.0.18 once available (GitHub Advisory). As an immediate workaround, implement network-level egress controls to block outbound requests from AgentScope instances to internal IP ranges, cloud metadata endpoints (169.254.169.254), and link-local addresses. Restrict AgentScope deployments from accepting user-supplied multimodal content blocks with arbitrary URL sources until a patch is applied. Monitor for suspicious outbound connections from AgentScope service processes and apply vendor patches as soon as they are released (Feedly).

The vulnerability was reported by researcher YLChen-007, who published a detailed proof-of-concept gist on March 11, 2026, describing the full non-blind SSRF impact including cloud credential theft scenarios. The vendor (modelscope) did not respond to early disclosure, which was noted in the CVE description and GitHub Advisory. The vulnerability received coverage from automated CVE tracking services including RedPacket Security and various CVE aggregators, but no significant broader media or researcher commentary has been identified (GitHub Advisory, PoC Gist).