OpenMAIC versions before 1.0.1 contain a Server-Side Request Forgery (SSRF) vulnerability that bypasses validation in non-production builds. Unauthenticated attackers can supply arbitrary provider URLs through the x-base-url header or baseUrl parameter. This allows attackers to reach cloud instance metadata services and access sensitive cloud credentials. The vulnerability exists due to environment-gated URL validation being skipped outside of production environments. The fix was introduced in OpenMAIC version 1.0.1. The issue affects the image generation API route and middleware components. Exploitation could lead to exposure of sensitive cloud infrastructure credentials and metadata. No authentication is required to exploit this vulnerability, increasing its severity.
