CVE-2026-6606
Published: 20 April 2026
Summary
CVE-2026-6606 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-6606 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting modelscope agentscope versions up to 1.0.18. The flaw exists in the _process_audio_block function located in the file src/agentscope/agent/_agent_base.py, where manipulation of the url argument enables the SSRF condition. Published on 2026-04-20, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and low complexity.
Remote attackers can exploit this vulnerability without requiring privileges or user interaction. By crafting and submitting a malicious url argument, they can induce the affected component to make unintended requests to arbitrary servers, potentially leading to limited impacts on confidentiality, integrity, and availability as per the CVSS metrics.
VulDB advisories detail the issue and note that the vendor was contacted early for disclosure but provided no response, with no patches or mitigations referenced. A proof-of-concept exploit is publicly available via a GitHub Gist, alongside VulDB entries for submission, vulnerability details, and CTI.
The public availability of the exploit heightens the risk of real-world attacks against deployments of this AI agent framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23777
Vulnerability details
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the…
more
attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability in network-accessible public-facing AI agent component (AV:N) directly enables T1190 for initial access via crafted URL requests to arbitrary servers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of the specific SSRF flaw in the _process_audio_block function of modelscope agentscope up to version 1.0.18.
Mandates validation of the manipulated url argument at the input interface to prevent SSRF exploitation.
Enforces information flow control policies to block unauthorized outbound requests to arbitrary servers induced by SSRF.