CVE-2026-6605

Medium

Published: 20 April 2026

Published

20 April 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0005 17.3th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6605 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-6605, published on 2026-04-20, is a server-side request forgery (SSRF) vulnerability classified under CWE-918 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It affects modelscope agentscope versions up to 1.0.18, specifically the _get_bytes_from_web_url function in the file src/agentscope/_utils/_common.py within the Internal Service component.

Remote attackers require no privileges or user interaction to exploit this flaw, enabling manipulation that triggers SSRF. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized internal resource access or outbound requests from the server.

Advisories from VulDB note that the vendor was contacted early for disclosure but provided no response, with no patches or official mitigations detailed. Relevant references include a public exploit at https://gist.github.com/YLChen-007/ced2d438ae79a5a11cea663c1ba2c954 and VulDB entries at https://vuldb.com/submit/792225, https://vuldb.com/vuln/358240, and https://vuldb.com/vuln/358240/cti.

The exploit has been publicly released and may be used in attacks, highlighting risks for deployments of this AI agent framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-23774

Vulnerability details

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the…

attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s): CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The described remote unauthenticated SSRF vulnerability in a server-side Internal Service component directly enables exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1