A server‑side request forgery vulnerability exists in the test_default_model handler of openagents’ HTTP transport package. By manipulating the base_url argument, an attacker can cause the application to make arbitrary HTTP requests to internal or external resources, potentially exposing sensitive data or facilitating further attacks. The weakness is a classic S2RFI flaw (CWE‑918) that allows an unauthenticated remote attacker to trigger the exploit from any context that can reach the vulnerable endpoint.

The flaw is present in openagents releases up to 0.8.19 and 0.9.3.post20. Any deployment of these versions or earlier is susceptible. The vulnerability resides in the function test_default_model within sdk/src/openagents/sdk/transports/http.py, while sibling admin endpoints protect themselves by calling the unused _require_admin() guard.

The vulnerability received a CVSS score of 6.9, indicating moderate severity. No EPSS data is available, so the current exploitation probability cannot be quantified. The flaw is not listed in CISA’s KEV catalog, but the public exploit code means it is likely to be used by attackers. The attack surface is remote, requiring only the ability to send a crafted request containing a malicious base_url value. If the application dynamically resolves internal addresses, the risk of unintended data exposure or service interruption is significant.