ChatGPTNextWeb — CraftedSignal Threat Feed

ChatGPTNextWeb NextChat Server-Side Request Forgery Vulnerability

hello@craftedsignal.io — Tue, 28 Apr 2026 12:00:00 +0000

A server-side request forgery (SSRF) vulnerability, identified as CVE-2026-7177, affects ChatGPTNextWeb NextChat up to version 2.16.1. The vulnerability resides within the proxyHandler function in the app/api/[provider]/[...path]/route.ts file. Publicly available exploits demonstrate that a remote attacker can manipulate this function to make unauthorized requests to internal resources. The project maintainers were notified, but have not yet responded to the issue, increasing the risk of widespread exploitation. This vulnerability allows attackers to potentially access sensitive information or internal services that are not intended to be exposed to the internet.

Attack Chain

An attacker identifies a NextChat instance running a vulnerable version (<= 2.16.1).
The attacker crafts a malicious HTTP request targeting the app/api/[provider]/[...path]/route.ts endpoint.
The crafted request manipulates the proxyHandler function parameters.
The proxyHandler function, without proper validation, forwards the manipulated request to an internal server or resource.
The internal server processes the request as if it originated from the NextChat server itself.
The internal server returns the response to the NextChat server.
The NextChat server forwards the response from the internal server back to the attacker.
The attacker gains access to potentially sensitive information or can interact with internal services due to the SSRF vulnerability.

Impact

Successful exploitation of this SSRF vulnerability allows attackers to potentially access internal resources, including sensitive data or internal services not intended for public access. While the CVSS score is 7.3 (HIGH), the impact is limited to information disclosure and limited modification/availability of resources. The number of affected instances is currently unknown. If successfully exploited, attackers could potentially use the compromised NextChat instance as a proxy to further compromise the internal network.

Recommendation

Apply input validation and sanitization to the proxyHandler function within app/api/[provider]/[...path]/route.ts to prevent malicious manipulation (Reference: CVE-2026-7177).
Monitor web server logs for unusual requests targeting the app/api endpoint with potentially malicious parameters (See example Sigma rule below).
Implement network segmentation to restrict access from the NextChat server to only necessary internal resources (General security best practice related to SSRF).
Deploy the Sigma rules provided to detect exploitation attempts against NextChat instances.

ChatGPTNextWeb NextChat SSRF Vulnerability (CVE-2026-7178)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A server-side request forgery (SSRF) vulnerability, identified as CVE-2026-7178, affects ChatGPTNextWeb NextChat versions up to 2.16.1. The vulnerability resides in the storeUrl function within the app/api/artifacts/route.ts file, specifically related to the Artifacts Endpoint component. An attacker can manipulate the ID argument to force the server to make requests to arbitrary internal or external resources. This issue was reported to the project maintainers but remains unpatched. The availability of a public exploit increases the risk of active exploitation. This vulnerability allows attackers to bypass network access controls, potentially accessing sensitive data or internal services.

Attack Chain

The attacker identifies an instance of ChatGPTNextWeb NextChat running a version up to 2.16.1.
The attacker crafts a malicious HTTP request targeting the /api/artifacts endpoint.
The request includes a manipulated ID parameter within the request body or query string of the HTTP request to storeUrl function.
The storeUrl function, lacking proper input validation, uses the attacker-supplied ID to construct a URL.
The NextChat server initiates an HTTP request to the attacker-controlled URL.
Depending on the crafted URL, the server may access internal resources, external websites, or cloud services.
The server receives the response from the target resource.
The attacker leverages the SSRF vulnerability to read sensitive internal data, interact with internal services, or potentially pivot to other internal systems.

Impact

Successful exploitation of CVE-2026-7178 allows an attacker to perform unauthorized actions within the network where the NextChat server is deployed. This may include reading internal files, accessing other internal applications or services, or potentially escalating privileges if the targeted internal service has its own vulnerabilities. Given the publicly available exploit, organizations using vulnerable versions of NextChat are at increased risk.

Recommendation

Upgrade ChatGPTNextWeb NextChat to a version greater than 2.16.1 to remediate CVE-2026-7178.
Deploy the Sigma rule “NextChat SSRF Attempt” to detect suspicious requests to the /api/artifacts endpoint with potentially malicious ID parameters.
Monitor web server logs for outbound connections originating from the NextChat server to unusual or internal IP addresses and domains.
Implement strict input validation on the ID parameter of the storeUrl function if immediate patching is not possible.

ChatGPTNextWeb NextChat Improper Authorization Vulnerability (CVE-2026-7644)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A vulnerability, CVE-2026-7644, affects ChatGPTNextWeb NextChat up to version 2.16.1. The flaw exists within the addMcpServer function located in the app/mcp/actions.ts file. This vulnerability allows for improper authorization, potentially enabling unauthorized actions. The exploit has been publicly disclosed, increasing the risk of exploitation. The vendor was notified, but there has been no response as of the time of this writing. This vulnerability allows for remote exploitation, meaning an attacker does not need local access to the system to exploit it. Defenders should prioritize patching or mitigating this vulnerability to prevent unauthorized access and potential data breaches.

Attack Chain

Attacker identifies a ChatGPTNextWeb NextChat instance running version 2.16.1 or earlier.
Attacker sends a crafted request to the addMcpServer function in app/mcp/actions.ts.
The application fails to properly authorize the request due to the vulnerability in addMcpServer.
The attacker bypasses authorization checks.
The attacker successfully adds a malicious MCP server configuration.
The application uses the malicious MCP server configuration, potentially leading to further unauthorized actions.
Attacker gains unauthorized access to sensitive data or functionality.

Impact

Successful exploitation of CVE-2026-7644 could lead to unauthorized access to a NextChat instance. An attacker could potentially manipulate MCP server configurations, leading to further compromise of the application and associated data. Since the exploit is publicly available, the risk of exploitation is significantly elevated, potentially affecting all unpatched instances of NextChat version 2.16.1 or earlier.

Recommendation

Upgrade ChatGPTNextWeb NextChat to a version higher than 2.16.1 to patch CVE-2026-7644.
Monitor web server logs for suspicious requests targeting the addMcpServer function in app/mcp/actions.ts.
Deploy the Sigma rule to detect unauthorized calls to the addMcpServer function.