CVE-2026-85686 — ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect f…
Published: 2026-09-04 · CVSS: 8.7 · CVSS 4.0
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7