Blind SSRF in LLMGateway via video-generation callback_url
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
LLMGateway through 1.20.0 contains a blind server-side request forgery flaw in the video-generation callback_url extension (CWE-918). An attacker holding an API key can supply loopback, private or cloud-metadata URLs that the worker sends webhook POSTs to, because the assertSafeWebhookTarget check is not applied, reaching internal services from the worker's network.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the assertSafeWebhookTarget check, reaching internal services from the worker's network.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for LLMGateway.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108719
- 2026-10-11 Alias added: GHSA-c996-f546-j683
- 2026-10-14 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 4
- https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/gateway/src/videos/videos.ts#L374-L383
- https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/worker/src/services/video-jobs.ts#L2490-L2499
- https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/worker/src/worker.ts#L2961-L2971
- https://github.com/theopenco/llmgateway
Sources
- CVE-2026-108719 · CVE Program
- CVE-2026-108719 · NVD
- FIRST EPSS
- GHSA-c996-f546-j683 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108719 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences