AIKIDO-2026-389326

TL;DR

The createProxy() route handler in the OpenAPI server builds a proxy that forwards requests to the origin supplied in the url query parameter. When no allowedOrigins or filterRequest allowlist is configured, the proxy forwards to any origin and follows upstream redirects without re-checking them, so an allowed upstream can redirect it to a disallowed destination. An unauthenticated attacker can abuse this as an open proxy to reach internal-only services and cloud metadata endpoints, and forwarded request headers and cookies are sent to the attacker-chosen target. The fix defaults allowedOrigins to the proxy route's own origin, warns when no allowlist is set, and enforces the allowlist on every redirect hop.