{"id":"CVE-2026-108719","summary":"LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url","details":"LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the assertSafeWebhookTarget check, reaching internal services from the worker's network.","modified":"2026-10-13T02:46:19.882557001Z","published":"2026-10-11T12:19:30.605Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108719.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108719.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind03/theopenco-llmgateway-video-callback-ssrf-no-egress-guard"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108719"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/llmgateway-through-1.20.0-blind-ssrf-via-video-generation-callback-url"},{"type":"PACKAGE","url":"https://github.com/theopenco/llmgateway"},{"type":"ARTICLE","url":"https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/gateway/src/videos/videos.ts#L374-L383"},{"type":"ARTICLE","url":"https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/worker/src/services/video-jobs.ts#L2490-L2499"},{"type":"ARTICLE","url":"https://github.com/theopenco/llmgateway/blob/c84ba987da18edd80358a3450ccaea75c5c67ca8/apps/worker/src/worker.ts#L2961-L2971"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theopenco/llmgateway","events":[{"introduced":"0"},{"fixed":"c84ba987da18edd80358a3450ccaea75c5c67ca8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.20.0"},{"fixed":"1.20.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["@llmgateway/models@1.342.2","@llmgateway/models@1.342.1","@llmgateway/models@1.342.0","@llmgateway/models@1.341.0","@llmgateway/models@1.340.0","@llmgateway/models@1.339.0","@llmgateway/models@1.338.3","@llmgateway/models@1.338.2","@llmgateway/models@1.338.1","@llmgateway/models@1.338.0","@llmgateway/models@1.337.0","@llmgateway/models@1.336.0","@llmgateway/models@1.335.1","@llmgateway/models@1.335.0","@llmgateway/models@1.334.0","@llmgateway/models@1.333.0","@llmgateway/models@1.332.1","v1.19.0","@llmgateway/models@1.332.0","@llmgateway/models@1.331.0","@llmgateway/models@1.330.0","@llmgateway/models@1.329.1","@llmgateway/models@1.329.0","@llmgateway/models@1.328.0","@llmgateway/models@1.327.1","@llmgateway/models@1.327.0","@llmgateway/models@1.326.0","@llmgateway/models@1.325.0","@llmgateway/models@1.324.0","@llmgateway/models@1.323.0","@llmgateway/models@1.322.0","@llmgateway/models@1.321.0","@llmgateway/models@1.320.2","@llmgateway/models@1.320.1","@llmgateway/models@1.320.0","@llmgateway/models@1.319.0","v1.18.0","@llmgateway/models@1.318.0","@llmgateway/models@1.317.0","@llmgateway/models@1.316.0","@llmgateway/models@1.315.0","@llmgateway/models@1.314.0","@llmgateway/models@1.313.1","@llmgateway/models@1.313.0","@llmgateway/models@1.312.0","@llmgateway/models@1.311.0","@llmgateway/models@1.310.0","@llmgateway/models@1.309.0","@llmgateway/models@1.308.0","v1.17.0","@llmgateway/models@1.307.0","@llmgateway/models@1.306.1","@llmgateway/models@1.306.0","@llmgateway/models@1.305.1","@llmgateway/models@1.305.0","@llmgateway/models@1.304.0","@llmgateway/models@1.303.0","@llmgateway/models@1.302.0","@llmgateway/models@1.301.0","@llmgateway/models@1.300.1","@llmgateway/models@1.300.0","@llmgateway/models@1.299.0","@llmgateway/models@1.298.1","@llmgateway/models@1.298.0","@llmgateway/models@1.297.1","@llmgateway/models@1.297.0","@llmgateway/models@1.296.0","v1.16.0","@llmgateway/models@1.295.1","@llmgateway/models@1.295.0","@llmgateway/models@1.294.0","@llmgateway/models@1.288.0","@llmgateway/models@1.293.0","@llmgateway/models@1.292.0","@llmgateway/models@1.291.0","@llmgateway/models@1.290.0","@llmgateway/models@1.289.0","@llmgateway/models@1.287.0","@llmgateway/models@1.286.1","@llmgateway/models@1.286.0","@llmgateway/models@1.285.0","@llmgateway/models@1.284.0","@llmgateway/models@1.283.4","@llmgateway/models@1.283.3","@llmgateway/models@1.283.2","@llmgateway/models@1.283.1","@llmgateway/models@1.283.0","@llmgateway/models@1.282.1","@llmgateway/models@1.282.0","@llmgateway/models@1.281.2","@llmgateway/models@1.281.1","@llmgateway/models@1.281.0","v1.15.0","@llmgateway/models@1.280.0","@llmgateway/models@1.279.1","@llmgateway/models@1.276.0","@llmgateway/models@1.275.0","@llmgateway/models@1.274.0","@llmgateway/models@1.273.1","@llmgateway/models@1.273.0","@llmgateway/models@1.271.0","@llmgateway/models@1.270.0","@llmgateway/models@1.269.2","@llmgateway/models@1.269.1","@llmgateway/models@1.269.0","@llmgateway/models@1.268.2","@llmgateway/models@1.268.1","v1.14.0","@llmgateway/models@1.268.0","@llmgateway/models@1.267.0","@llmgateway/models@1.266.0","@llmgateway/models@1.265.0","@llmgateway/models@1.264.1","@llmgateway/models@1.264.0","@llmgateway/models@1.263.0","@llmgateway/models@1.262.1","@llmgateway/models@1.262.0","@llmgateway/models@1.261.3","@llmgateway/models@1.261.2","@llmgateway/models@1.261.1","@llmgateway/models@1.261.0","@llmgateway/models@1.260.0","@llmgateway/models@1.259.0","@llmgateway/models@1.258.0","@llmgateway/models@1.257.0","@llmgateway/models@1.256.0","@llmgateway/models@1.255.0","@llmgateway/models@1.254.0","@llmgateway/models@1.253.1","v1.13.0","@llmgateway/models@1.253.0","@llmgateway/models@1.252.0","@llmgateway/models@1.251.0","@llmgateway/models@1.250.0","@llmgateway/models@1.249.2","@llmgateway/models@1.249.1","@llmgateway/models@1.249.0","@llmgateway/models@1.248.1","@llmgateway/models@1.248.0","@llmgateway/models@1.247.0","@llmgateway/models@1.246.0","@llmgateway/models@1.245.1","@llmgateway/models@1.245.0","@llmgateway/models@1.244.0","@llmgateway/models@1.243.0","@llmgateway/models@1.242.1","@llmgateway/models@1.242.0","@llmgateway/models@1.241.1","@llmgateway/models@1.241.0","@llmgateway/models@1.240.1","v1.12.0","@llmgateway/models@1.240.0","@llmgateway/models@1.239.0","@llmgateway/models@1.238.1","@llmgateway/models@1.238.0","@llmgateway/models@1.237.0","@llmgateway/models@1.236.0","@llmgateway/models@1.235.2","@llmgateway/models@1.235.1","@llmgateway/models@1.235.0","@llmgateway/models@1.234.0","@llmgateway/models@1.233.0","@llmgateway/models@1.232.0","@llmgateway/models@1.231.0","@llmgateway/models@1.230.0","@llmgateway/models@1.229.0","@llmgateway/models@1.228.1","@llmgateway/models@1.228.0","@llmgateway/models@1.227.0","@llmgateway/models@1.226.2","@llmgateway/models@1.226.1","@llmgateway/models@1.226.0","@llmgateway/models@1.225.0","@llmgateway/models@1.224.0","@llmgateway/models@1.223.1","@llmgateway/models@1.223.0","@llmgateway/models@1.222.0","@llmgateway/models@1.221.0","@llmgateway/models@1.220.0","@llmgateway/models@1.219.0","v1.11.0","@llmgateway/models@1.218.4","@llmgateway/models@1.218.3","@llmgateway/models@1.218.2","@llmgateway/models@1.218.1","@llmgateway/models@1.218.0","@llmgateway/models@1.217.0","@llmgateway/models@1.216.0","@llmgateway/models@1.215.0","@llmgateway/models@1.214.0","@llmgateway/models@1.213.0","@llmgateway/models@1.212.1","@llmgateway/models@1.212.0","@llmgateway/models@1.211.1","@llmgateway/models@1.211.0","@llmgateway/models@1.210.0","@llmgateway/models@1.209.0","@llmgateway/models@1.208.0","@llmgateway/models@1.207.1","@llmgateway/models@1.207.0","@llmgateway/models@1.206.2","@llmgateway/models@1.206.1","@llmgateway/models@1.206.0","@llmgateway/models@1.205.0","@llmgateway/models@1.204.0","@llmgateway/models@1.203.0","@llmgateway/models@1.202.0","v1.10.0","@llmgateway/models@1.201.1","@llmgateway/models@1.201.0","@llmgateway/models@1.200.1","@llmgateway/models@1.200.0","@llmgateway/models@1.199.1","@llmgateway/models@1.199.0","@llmgateway/models@1.198.0","@llmgateway/models@1.197.0","@llmgateway/models@1.196.0","@llmgateway/models@1.195.1","@llmgateway/models@1.195.0","@llmgateway/models@1.194.0","@llmgateway/models@1.193.0","@llmgateway/models@1.192.1","@llmgateway/models@1.192.0","@llmgateway/models@1.191.0","@llmgateway/models@1.190.0","@llmgateway/models@1.189.3","@llmgateway/models@1.189.2","@llmgateway/models@1.189.1","@llmgateway/models@1.189.0","@llmgateway/models@1.188.0","@llmgateway/models@1.187.1","v1.9.0","@llmgateway/models@1.187.0","@llmgateway/models@1.186.1","@llmgateway/models@1.186.0","@llmgateway/models@1.185.1","@llmgateway/models@1.185.0","@llmgateway/models@1.184.0","@llmgateway/models@1.183.1","@llmgateway/models@1.183.0","@llmgateway/models@1.182.1","@llmgateway/models@1.182.0","@llmgateway/models@1.181.0","@llmgateway/models@1.180.3","@llmgateway/models@1.180.2","@llmgateway/models@1.180.1","@llmgateway/models@1.180.0","@llmgateway/models@1.179.0","@llmgateway/models@1.178.0","@llmgateway/models@1.177.2","@llmgateway/models@1.177.1","@llmgateway/models@1.177.0","@llmgateway/models@1.176.0","@llmgateway/models@1.175.0","@llmgateway/models@1.174.0","@llmgateway/models@1.173.1","@llmgateway/models@1.173.0","@llmgateway/models@1.172.0","@llmgateway/models@1.171.0","@llmgateway/models@1.170.0","@llmgateway/models@1.169.0","@llmgateway/models@1.168.0","v1.8.0","@llmgateway/models@1.167.1","@llmgateway/models@1.167.0","@llmgateway/models@1.166.0","@llmgateway/models@1.165.0","@llmgateway/models@1.164.0","@llmgateway/models@1.163.1","@llmgateway/models@1.163.0","@llmgateway/models@1.162.0","@llmgateway/models@1.161.0","@llmgateway/models@1.160.0","@llmgateway/models@1.159.0","@llmgateway/models@1.158.0","@llmgateway/models@1.157.0","@llmgateway/models@1.156.0","@llmgateway/models@1.155.0","@llmgateway/models@1.154.0","@llmgateway/models@1.153.0","@llmgateway/models@1.152.0","@llmgateway/models@1.151.2","v1.7.0","@llmgateway/models@1.151.1","@llmgateway/models@1.151.0","@llmgateway/models@1.150.0","@llmgateway/models@1.149.0","@llmgateway/models@1.148.0","@llmgateway/models@1.147.1","@llmgateway/models@1.147.0","@llmgateway/models@1.146.1","@llmgateway/models@1.146.0","@llmgateway/models@1.145.0","@llmgateway/models@1.144.1","@llmgateway/models@1.144.0","@llmgateway/models@1.143.2","@llmgateway/models@1.143.1","@llmgateway/models@1.143.0","v1.6.0","@llmgateway/models@1.142.0","@llmgateway/models@1.141.2","@llmgateway/models@1.141.1","@llmgateway/models@1.141.0","@llmgateway/models@1.140.1","@llmgateway/models@1.140.0","@llmgateway/models@1.139.0","@llmgateway/models@1.138.0","@llmgateway/models@1.137.3","@llmgateway/models@1.137.2","@llmgateway/models@1.137.1","@llmgateway/models@1.137.0","@llmgateway/models@1.136.2","@llmgateway/models@1.136.1","v1.5.0","@llmgateway/models@1.136.0","@llmgateway/models@1.135.0","v1.4.0","@llmgateway/models@1.134.1","@llmgateway/models@1.134.0","@llmgateway/models@1.133.0","@llmgateway/models@1.132.0","@llmgateway/models@1.131.0","@llmgateway/models@1.130.0","@llmgateway/models@1.129.0","@llmgateway/models@1.128.1","@llmgateway/models@1.128.0","@llmgateway/models@1.127.0","@llmgateway/models@1.126.0","@llmgateway/models@1.125.4","@llmgateway/models@1.125.3","@llmgateway/models@1.125.2","@llmgateway/models@1.125.1","@llmgateway/models@1.125.0","@llmgateway/models@1.124.0","@llmgateway/models@1.123.0","@llmgateway/models@1.122.0","@llmgateway/models@1.121.1","@llmgateway/models@1.121.0","@llmgateway/models@1.120.2","@llmgateway/models@1.120.1","@llmgateway/models@1.120.0","@llmgateway/models@1.119.0","@llmgateway/models@1.118.0","@llmgateway/models@1.117.2","@llmgateway/models@1.117.1","@llmgateway/models@1.117.0","@llmgateway/models@1.116.0","@llmgateway/models@1.115.0","@llmgateway/models@1.114.1","@llmgateway/models@1.114.0","@llmgateway/models@1.113.2","@llmgateway/models@1.113.1","@llmgateway/models@1.113.0","@llmgateway/models@1.112.0","@llmgateway/models@1.111.0","@llmgateway/models@1.110.2","@llmgateway/models@1.110.1","@llmgateway/models@1.110.0","@llmgateway/models@1.109.0","@llmgateway/models@1.108.0","@llmgateway/models@1.107.0","@llmgateway/models@1.106.1","@llmgateway/models@1.106.0","@llmgateway/models@1.105.0","@llmgateway/models@1.104.0","@llmgateway/models@1.103.0","@llmgateway/models@1.102.0","@llmgateway/models@1.101.0","@llmgateway/models@1.100.1","@llmgateway/models@1.100.0","@llmgateway/models@1.99.1","@llmgateway/models@1.99.0","@llmgateway/models@1.98.0","@llmgateway/models@1.97.1","@llmgateway/models@1.97.0","@llmgateway/models@1.96.1","@llmgateway/models@1.96.0","@llmgateway/models@1.95.0","@llmgateway/models@1.94.0","@llmgateway/models@1.93.0","@llmgateway/models@1.92.1","@llmgateway/models@1.92.0","@llmgateway/models@1.90.1","@llmgateway/models@1.91.0","@llmgateway/models@1.90.0","@llmgateway/models@1.89.0","@llmgateway/models@1.88.0","@llmgateway/models@1.87.0","@llmgateway/models@1.86.0","@llmgateway/models@1.85.0","@llmgateway/models@1.84.0","@llmgateway/models@1.83.2","@llmgateway/models@1.83.1","@llmgateway/models@1.83.0","@llmgateway/models@1.82.0","@llmgateway/models@1.81.0","@llmgateway/models@1.80.0","@llmgateway/models@1.79.0","@llmgateway/models@1.78.0","@llmgateway/models@1.77.2","@llmgateway/models@1.77.1","@llmgateway/models@1.77.0","@llmgateway/models@1.76.0","@llmgateway/models@1.75.0","@llmgateway/models@1.74.3","@llmgateway/models@1.74.2","@llmgateway/models@1.74.1","@llmgateway/models@1.74.0","@llmgateway/models@1.73.0","@llmgateway/models@1.72.0","@llmgateway/models@1.71.1","@llmgateway/models@1.71.0","@llmgateway/models@1.70.0","@llmgateway/models@1.69.0","@llmgateway/models@1.68.0","@llmgateway/models@1.67.1","@llmgateway/models@1.67.0","@llmgateway/models@1.66.0","@llmgateway/models@1.65.0","@llmgateway/models@1.64.0","@llmgateway/models@1.63.2","@llmgateway/models@1.63.1","@llmgateway/models@1.63.0","@llmgateway/models@1.62.0","@llmgateway/models@1.61.0","@llmgateway/models@1.60.1","@llmgateway/models@1.60.0","@llmgateway/models@1.59.1","@llmgateway/models@1.59.0","@llmgateway/models@1.58.0","@llmgateway/models@1.57.0","@llmgateway/models@1.56.0","@llmgateway/models@1.55.0","@llmgateway/models@1.54.0","@llmgateway/models@1.53.0","@llmgateway/models@1.52.0","@llmgateway/models@1.51.0","@llmgateway/models@1.50.2","@llmgateway/models@1.50.1","@llmgateway/models@1.50.0","@llmgateway/models@1.49.1","@llmgateway/models@1.49.0","@llmgateway/models@1.48.3","@llmgateway/models@1.48.2","@llmgateway/models@1.48.1","@llmgateway/models@1.48.0","@llmgateway/models@1.47.0","@llmgateway/models@1.46.0","@llmgateway/models@1.45.0","@llmgateway/models@1.44.1","@llmgateway/models@1.44.0","@llmgateway/models@1.43.1","@llmgateway/models@1.43.0","@llmgateway/models@1.42.1","@llmgateway/models@1.42.0","@llmgateway/models@1.41.0","@llmgateway/models@1.40.0","@llmgateway/models@1.39.0","@llmgateway/models@1.38.0","@llmgateway/models@1.37.0","@llmgateway/models@1.36.1","@llmgateway/models@1.36.0","@llmgateway/models@1.35.1","@llmgateway/models@1.35.0","@llmgateway/models@1.34.0","@llmgateway/models@1.33.0","@llmgateway/models@1.32.0","@llmgateway/models@1.31.1","@llmgateway/models@1.31.0","@llmgateway/models@1.30.0","@llmgateway/models@1.29.1","@llmgateway/models@1.29.0","@llmgateway/models@1.28.0","@llmgateway/models@1.27.0","@llmgateway/models@1.26.0","@llmgateway/models@1.25.0","@llmgateway/models@1.24.0","@llmgateway/models@1.23.0","@llmgateway/models@1.22.3","@llmgateway/models@1.22.2","@llmgateway/models@1.22.1","@llmgateway/models@1.22.0","@llmgateway/models@1.21.2","@llmgateway/models@1.21.1","@llmgateway/models@1.21.0","@llmgateway/models@1.20.1","@llmgateway/models@1.20.0","@llmgateway/models@1.19.1","@llmgateway/models@1.19.0","@llmgateway/models@1.18.0","@llmgateway/models@1.17.0","@llmgateway/models@1.16.2","@llmgateway/models@1.16.1","@llmgateway/models@1.16.0","@llmgateway/models@1.15.0","@llmgateway/models@1.14.0","@llmgateway/models@1.13.0","@llmgateway/models@1.12.1","@llmgateway/models@1.12.0","@llmgateway/models@1.11.0","@llmgateway/models@1.10.2","@llmgateway/models@1.10.1","@llmgateway/models@1.10.0","@llmgateway/models@1.9.0","@llmgateway/models@1.8.0","@llmgateway/models@1.7.0","@llmgateway/models@1.6.1","@llmgateway/models@1.6.0","@llmgateway/models@1.5.3","@llmgateway/models@1.5.2","@llmgateway/models@1.5.1","@llmgateway/models@1.5.0","@llmgateway/models@1.4.0","@llmgateway/models@1.3.1","@llmgateway/models@1.3.0","@llmgateway/models@1.2.1","@llmgateway/models@1.2.0","@llmgateway/models@1.1.1","@llmgateway/models@1.1.0","@llmgateway/models@1.0.1","@llmgateway/models@1.0.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108719.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}