EUVD-2026-44953

text-generation-inference through 3.3.7 contains a server-side request forgery SSRF vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted imageu...

CVE-2026-63086 text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions

text-generation-inference through 3.3.7 contains a server-side request forgery SSRF vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted imageu...

CVE-2026-63086

The CVE-2026-63086 entry concerns text-generation-inference 3.3.7, with an SSRF flaw in the OpenAI-compatible multimodal chat completions endpoint. The fetch_image function in router/src/validation.rs does not validate addresses (private, loopback, link-local, or cloud metadata). The HTTP client ...