CVE-2026-85686

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...

CVE-2026-85686

ms-swift 4.5.2 (ModelScope) contains an unauthenticated SSRF in the swift deploy OpenAI-compatible API. The vulnerable component is vision_utils.py, which fetches multimodal media URLs (image_url , audio_url , video_url ) without URL validation or redirect filtering. An attacker can supply arbitr...