AI 系統安全
OpenMAIC 1.0.1 Patches Four Vulnerabilities; Unauthenticated Model Endpoints Could Be Used to Access Cloud Metadata
Tsinghua University’s multi-agent classroom platform OpenMAIC has patched an SSRF vulnerability that could be triggered without authentication, along with stored XSS, path traversal, and redirect-validation flaws. The upgrade also tightens settings for local models and development-time validation, meaning self-hosted users cannot simply replace the container while ignoring environment variables.
OpenMAIC 1.0.1 was released on September 6, patching four security issues that were privately disclosed. The most severe, GHSA-9m7h-vh2h-rc3w, affects version 1.0.0 and earlier. By default, when `ACCESS_CODE` was not configured, the middleware allowed API requests through. In addition, five routes accepting user-defined model or media endpoints performed SSRF checks only when `NODE_ENV=production`. Combined, these conditions allowed an external request to force the server to connect to cloud instance metadata services such as `169.254.169.254`, potentially returning temporary IAM credentials in the response. GitHub rated the issue Critical, with a CVSS 4.0 score of 9.0.
The other three vulnerabilities span different trust boundaries. Stage IDs were not restricted when classroom data was written, potentially allowing paths to escape the intended directory. Persisted slide HTML was not sanitized before storage, resulting in stored XSS. Model-provider requests followed redirects without revalidating the destination at each hop. The patched release sanitizes HTML at the persistence boundary, restricts the characters permitted in stage IDs, and validates every redirect while stripping credential headers from cross-origin requests. The project also added scanning tests to prevent protected call sites from once again enabling checks only in specific environments.
The implications of this incident extend beyond a single educational tool. OpenMAIC can accept documents, generate slides and videos, and let users configure OpenAI-compatible or local model endpoints. This type of “configurable backend” design effectively provides server-side network egress. If the application also treats development mode, preview deployments, or passwordless configurations as trusted environments, model functionality can become a pathway into the cloud control plane.
Self-hosted users should upgrade to 1.0.1, rotate any cloud credentials that may have been exposed, and review egress firewall rules and IMDS protections. The new minimum requirement is Node 22.19. Loopback and private addresses are now rejected by default in development environments as well; connecting to local services such as Ollama or Lemonade requires explicitly setting `ALLOW_LOCAL_NETWORKS=true`. This compatibility change should not be dismissed as routine upgrade noise. It is a prompt to reassess the security boundary governing which processes may issue requests to internal networks on the server’s behalf.