Server-Side Request Forgery in Unstructured URL Partitioning

The unstructured Python library, widely used for URL ingestion in agent frameworks such as LangChain and LlamaIndex, contains a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in the partition(), partition_html(), and partition_md() functions, which utilize requests.get() to fetch remote content without performing host validation, URL filtering, or restricting requests to private/loopback IP spaces.

This vulnerability allows an attacker to provide an arbitrary URL to these functions, which the application then requests. Because the library returns the response body as text, it facilitates a full-read SSRF. This enables attackers to reach sensitive internal services, such as administrative APIs, databases, and microservices, or to query cloud instance metadata services (IMDS). The vulnerability has existed since version 0.4.7 (February 2023) and remains present in versions up to 0.24.0. The lack of timeouts in partition_md() further introduces potential denial-of-service risks via slow-loris patterns.

Attack Chain

1. Attacker identifies an internet-facing application that uses the unstructured library to process user-provided URLs (e.g., an LLM agent feature or link-preview generator).
2. Attacker crafts a malicious URL pointing to an internal resource (e.g., http://127.0.0.1:80 or http://169.254.169.254/latest/meta-data/).
3. Attacker submits the crafted URL to the target application's ingestion endpoint.
4. The application passes the URL to unstructured.partition.auto.partition().
5. The library performs an unvalidated HTTP GET request to the target internal host using the server's identity.
6. The target internal service processes the request and returns sensitive data (e.g., IMDS credentials or admin dashboard HTML) to the library.
7. The library parses the returned sensitive data as document text and embeds it into the LLM context or application output.
8. Attacker views the output containing the exfiltrated sensitive data.

Impact

Successful exploitation allows attackers to perform reconnaissance on internal networks, gain access to sensitive internal HTTP services (e.g., Redis, Consul, Kubernetes API), and exfiltrate cloud instance credentials from metadata endpoints that permit unauthenticated GET requests. Organizations leveraging this library within agentic frameworks are at significant risk of unauthorized internal access, as the vulnerability resides within the ingestion layer, making every downstream implementation potentially susceptible.

Recommendation

1. Upgrade the unstructured library to version 0.24.0 or later immediately to patch CVE-2026-71428.
2. If an immediate upgrade is not possible, implement strict URL validation logic at the application layer to block requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and the cloud metadata link-local address (169.254.169.254).
3. Restrict egress traffic from servers running document ingestion workflows using host-based firewalls or network egress filtering to prevent unauthorized internal connectivity.