BREAKING: CVE-2026-86259 lets unauth OpenMAIC callers pull cloud credentials via SSRF

OpenMAIC before 1.0.1 will fetch any URL you put in x-base-url when the SSRF guard is skipped, and the default install has no access code. On a cloud host that means an unauthenticated caller can pull Instance Metadata Service credentials through generation endpoints such as POST /api/generate/image. Same-day GHSA-9m7h-vh2h-rc3w and release v1.0.1 ship today. CVE-2026-86259 is the lead. Three sibling advisories land in the same upgrade.

This is the operator write-up. The HOL Guard evidence pack for CVE-2026-86259 is the source record.

What breaks

Two defaults stack:

• Fail-open auth. middleware.ts does if (!accessCode) return NextResponse.next(). The shipped .env.example leaves ACCESS_CODE commented optional, so every API route is reachable with no cookie.
• Environment-gated SSRF. In 1.0.0, routes such as app/api/generate/image/route.ts only called validateUrlForSSRF(clientBaseUrl) when NODE_ENV === 'production'. Development, staging, preview, and unset environments skipped the guard and fetched the client URL.

Chain: unset ACCESS_CODE + non-production NODE_ENV + x-base-url pointing at the cloud metadata service on an image, video, PDF, or extract route. The server returns IAM material in the response. The same pattern also reaches loopback services when those ports are open on the host.

v1.0.1 removes the NODE_ENV gate so validateUrlForSSRF runs unconditionally, and adds a repository test that fails if a gated call site comes back. CHANGELOG 1.0.1 also lists three other fixes in the same tag: classroom path write (GHSA-p2wh-m28m-c5xw), stored slide HTML (GHSA-7rhf-2798-mvcj), and redirect credential drop (GHSA-725p-44hx-v52c).

The incomplete part of 1.0.1

Read the patch, not only the advisory remediation list. GHSA-9m7h suggested fail-closed middleware when ACCESS_CODE is missing. The shipped 1.0.1 tree does not do that. middleware.ts is byte-identical between v1.0.0 and v1.0.1; the fail-open if (!accessCode) return NextResponse.next() remains. README and .env.example still document ACCESS_CODE as optional.

So: upgrading closes the SSRF gate everywhere, including non-production. It does not by itself stop unauthenticated callers from hitting your API surface. Set ACCESS_CODE in .env.local (or your deploy secrets) on every reachable instance.

Breaking change after upgrade: client-supplied loopback or private provider base URLs (local Ollama or Lemonade entered in Settings) are now rejected in every environment unless you set ALLOW_LOCAL_NETWORKS=true. Production already behaved that way; development did not.

Who is not in scope

• Deployments that already run with NODE_ENV=production (SSRF validation was already on) and a non-empty ACCESS_CODE.
• Managed or server-configured providers that ignore client x-base-url (OpenMAIC managed-provider path drops the client base URL).
• Hosted open.maic.chat instances that enforce access codes.
• Anyone not running OpenMAIC.

Operator check

grep -n '^ACCESS_CODE=' .env.local .env 2>/dev/null
node -p "require('./package.json').version"

Expect ACCESS_CODE set to a real secret and version 1.0.1 or newer. Empty grep output means the middleware still fail-opens even after you upgrade.

How to fix

git fetch --tags && git checkout v1.0.1
pnpm install && pnpm build && pnpm start

Then set a strong ACCESS_CODE=... in .env.local (or your secret store) and restart. If you point Settings at a local LLM endpoint, add ALLOW_LOCAL_NETWORKS=true. Node must be 22.19.0 or newer after this release.

Rotate any cloud credentials that lived on hosts that exposed OpenMAIC without an access code before you patched. Treat temporary IMDS tokens as compromised for the full window the instance was reachable.

What this is not

Not a Next.js framework CVE. Not remote code execution by itself. Not wormable without a reachable OpenMAIC. Not fixed by only bumping the Next.js, undici, or lodash deps that also landed in 1.0.1.

References

• GHSA-9m7h-vh2h-rc3w (lead SSRF / unauth chain)
• OpenMAIC v1.0.1 release
• CHANGELOG 1.0.1
• Patch observation: app/api/generate/image/route.ts drops the NODE_ENV === 'production' gate; middleware.ts unchanged vs 1.0.0
• Siblings in the same release: GHSA-p2wh-m28m-c5xw, GHSA-7rhf-2798-mvcj, GHSA-725p-44hx-v52c