---
id: "CVE-2026-112297"
kind: "vulnerability"
aliases: ["CVE-2026-112297"]
title: "anx-calibre-manager: LLM base URL setting enables server-side request forgery"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "calibre", "python", "self-hosted"]
not_affected_if: ["no-llm-config-exposed", "restricted-egress"]
published_at: "2026-10-19T20:17:53+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:39:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112297", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# anx-calibre-manager: LLM base URL setting enables server-side request forgery

anx-calibre-manager up to version 1.13.12 passes a user-supplied base_url to its LLM client in LLMClient.chat, so the server makes requests to any address the attacker names. An attacker can use the server to reach internal services or other hosts it can see, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed version is `1.13.12` or earlier.
- Check whether the LLM Configuration feature (blueprints/api/llm.py) is reachable from untrusted networks.
- Whether the app accepts a custom base_url is unknown from the sources.

## Fix

- Upgrade past `1.13.12` if a fixed release exists; the sources do not name one.
- Restrict access to the LLM configuration endpoint until a fix is available.
- Block outbound requests from the app server to internal addresses as a stopgap.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112297

## From the sources

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_