CVE-2026-2654
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in huggingface smolagents 1.24.0. Attackers can exploit the LocalPythonExecutor component to make unauthorized requests from the vulnerable server, potentially accessing internal systems. Organizations using smolagents 1.24.0 with internet-facing deployments are at risk.
💻 Affected Systems
- huggingface smolagents
📦 What is this software?
Smolagents by Huggingface
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration, and lateral movement to other systems via the vulnerable server as a pivot point.
Likely Case
Unauthorized access to internal HTTP services, metadata services (like AWS/Azure instance metadata), or internal APIs accessible from the vulnerable server.
If Mitigated
Limited impact with proper network segmentation, egress filtering, and request validation in place.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Input Validation and URL Whitelisting
allImplement strict validation of URLs passed to LocalPythonExecutor, allowing only trusted domains.
Network Egress Filtering
allConfigure firewall rules to restrict outbound connections from the smolagents server to only necessary destinations.
🧯 If You Can't Patch
- Isolate the vulnerable system in a restricted network segment with limited outbound access.
- Implement web application firewall (WAF) rules to detect and block SSRF patterns in requests.
🔍 How to Verify
Check if Vulnerable:
Check if smolagents version is 1.24.0 and if LocalPythonExecutor is configured to accept external URL inputs.Check Version:
pip show smolagents | grep VersionVerify Fix Applied:
Test if URL validation prevents requests to internal or unauthorized external addresses.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from smolagents process to internal IP ranges or metadata services
Network Indicators:
- HTTP requests from smolagents server to unexpected internal destinations or cloud metadata endpoints
SIEM Query:
source="smolagents" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16 OR dest_ip=169.254.169.254)