LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves DNS without re-validation, enabling attackers to use HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.

LLaMA-Factory, an open-source LLM fine-tuning framework, contains a server-side request forgery (SSRF) vulnerability in its OpenAI-compatible API multimodal media URL handler. The vulnerability stems from a flawed SSRF mitigation: the check_ssrf_url guard validates URLs only once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation. This allows unauthenticated attackers to exploit HTTP redirects or DNS rebinding techniques to bypass the SSRF protection. Successful exploitation enables attackers to reach internal network addresses and cloud metadata endpoints such as AWS IMDSv1. The vulnerability affects LLaMA-Factory version 0.9.5 and is tracked as CVE-2026-85673. The flaw is particularly dangerous in cloud-hosted deployments where metadata services expose sensitive credentials and configuration data.