{"id":"CVE-2026-112297","kind":"vulnerability","aliases":["CVE-2026-112297"],"related":[],"title":"anx-calibre-manager: LLM base URL setting enables server-side request forgery","description":"A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"anx-calibre-manager up to version 1.13.12 passes a user-supplied base_url to its LLM client in LLMClient.chat, so the server makes requests to any address the attacker names. An attacker can use the server to reach internal services or other hosts it can see, and a public exploit has been published.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","calibre","python","self-hosted"],"not_affected_if":["no-llm-config-exposed","restricted-egress"],"how_to_check":"- Check whether the installed version is `1.13.12` or earlier.\n- Check whether the LLM Configuration feature (blueprints/api/llm.py) is reachable from untrusted networks.\n- Whether the app accepts a custom base_url is unknown from the sources.","fix":"- Upgrade past `1.13.12` if a fixed release exists; the sources do not name one.\n- Restrict access to the LLM configuration endpoint until a fix is available.\n- Block outbound requests from the app server to internal addresses as a stopgap.","status":"open","published_at":"2026-10-19T20:17:53+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:39:37+00:00","updated_at":"2026-10-25T04:39:37+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:39:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past `1.13.12` if a fixed release exists; the sources do not name one.\n- Restrict access to the LLM configuration endpoint until a fix is available.\n- Block outbound requests from the app server to internal addresses as a stopgap.","reach":"internet","title":"anx-calibre-manager: LLM base URL setting enables server-side request forgery","impact":"medium","summary":"anx-calibre-manager up to version 1.13.12 passes a user-supplied base_url to its LLM client in LLMClient.chat, so the server makes requests to any address the attacker names. An attacker can use the server to reach internal services or other hosts it can see, and a public exploit has been published.","category":"ai-tooling","nicknames":[],"who_cares":["self-hosted","calibre","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker makes the server send requests to internal hosts","analyst_note":"Find whether a fixed version exists and whether the endpoint requires login; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112297 and the upstream repo.","how_to_check":"- Check whether the installed version is `1.13.12` or earlier.\n- Check whether the LLM Configuration feature (blueprints/api/llm.py) is reachable from untrusted networks.\n- Whether the app accepts a custom base_url is unknown from the sources.","needs_analyst":true,"not_affected_if":["no-llm-config-exposed","restricted-egress"],"who_is_affected":"Instances of anx-calibre-manager up to 1.13.12 that expose the LLM Configuration endpoint, where a remote client can set base_url. Deployments that never reach this endpoint from outside, or that restrict outbound traffic, have lower exposure. The sources do not say whether authentication is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001066,"input_tokens":3355,"output_tokens":1462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112297':17A,20A '-2026':16A,19A '1.13.12':36B,97C 'address':57B 'ai':22B 'ai-tool':21B 'anx':2A,30B,92C 'anx-calibre-manag':1A,29B,91C 'argument':119C 'attack':59B,62B,129C 'base':6A,42B,120C 'blueprints/api/llm.py':108C 'calibr':3A,24B,31B,93C 'caus':122C 'client':47B 'compon':111C 'configur':113C 'contact':146C 'cve':15A,18A 'disclosur':150C 'earli':147C 'element':100C 'enabl':9A 'exploit':80B,135C 'file':107C 'flaw':85C 'forgeri':14A,127C 'found':88C 'function':103C 'handler':114C 'host':28B,73B 'impact':99C 'initi':132C 'intern':69B 'llm':5A,46B,112C 'llmclient.chat':49B,104C 'make':53B 'manag':4A,32B,94C 'manipul':116C 'may':140C 'name':60B 'pass':37B 'ptbsare':90C 'public':79B 'publish':83B,138C 'python':25B 'reach':68B 'remot':133C 'request':13A,54B,126C 'respond':154C 'see':76B 'self':27B 'self-host':26B 'server':11A,52B,66B,124C 'server-sid':10A,123C 'servic':70B 'set':8A 'side':12A,125C 'suppli':41B 'tool':23B 'url':7A,43B,121C 'use':64B,142C 'user':40B 'user-suppli':39B 'vendor':144C 'version':35B 'way':157C","nicknames":[],"mitigations":[],"who_affected":"Instances of anx-calibre-manager up to 1.13.12 that expose the LLM Configuration endpoint, where a remote client can set base_url. Deployments that never reach this endpoint from outside, or that restrict outbound traffic, have lower exposure. The sources do not say whether authentication is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112297","severity":null,"published_at":"2026-10-19T20:17:53+00:00","modified_at":"2026-10-22T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}