AIKIDO-2026-15944

@openai/codex is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published Today

Medium Risk

This Affects:

@openai/codex

0.1.4160940 - 0.151.0

Fixed in 0.152.0

Are you affected? Scan for Free

TL;DR

Codex cloud task requests can carry saved ChatGPT credentials. The cloud task client does not restrict the configured backend URL to trusted origins and follows HTTP redirects, so a redirect or an untrusted backend base URL can forward the credentials to an attacker-controlled destination. This exposes the user's authentication token. The fix validates the backend URL against trusted HTTPS origins, rejects URLs carrying user info, queries, or fragments, and disables redirects before credentials are loaded.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Codex cloud tasks feature with a backend URL or backend redirect that can be influenced by untrusted input.