CVE-2026-6605
Published: 20 April 2026
Summary
CVE-2026-6605 is a high-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and remediation of the SSRF flaw in the _get_bytes_from_web_url function of agentscope.
Mandates validation of URL inputs to the vulnerable function to block SSRF manipulations.
Implements boundary protections to restrict unauthorized outbound requests or internal resource access triggered by SSRF.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The described remote unauthenticated SSRF vulnerability in a server-side Internal Service component directly enables exploitation of public-facing applications.
NVD Description
A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the…
more
attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-6605, published on 2026-04-20, is a server-side request forgery (SSRF) vulnerability classified under CWE-918 with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It affects modelscope agentscope versions up to 1.0.18, specifically the _get_bytes_from_web_url function in the file src/agentscope/_utils/_common.py within the Internal Service component.
Remote attackers require no privileges or user interaction to exploit this flaw, enabling manipulation that triggers SSRF. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability, such as unauthorized internal resource access or outbound requests from the server.
Advisories from VulDB note that the vendor was contacted early for disclosure but provided no response, with no patches or official mitigations detailed. Relevant references include a public exploit at https://gist.github.com/YLChen-007/ced2d438ae79a5a11cea663c1ba2c954 and VulDB entries at https://vuldb.com/submit/792225, https://vuldb.com/vuln/358240, and https://vuldb.com/vuln/358240/cti.
The exploit has been publicly released and may be used in attacks, highlighting risks for deployments of this AI agent framework.
Details
- CWE(s)