CVE-2024-4084 is a high severity server-side request forgery in mintplex-labs anything-llm. NVD scores it 7.5. The record says an earlier fix for internal address access could be bypassed. Upgrade to the newest release, confirm the fixed version in the advisory, and block internal ranges at the network level.
What's affected
The record lists the latest version of anything-llm at the time of the report, without a version number. It describes a bypass of an earlier fix. That fix tried to block addresses starting with 192, 172, 10 and 127 using regular expressions, and limited protocols to HTTP and HTTPS. The record says alternative ways of writing IP addresses, and other ports on localhost, still got through.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: remote, no privileges, high confidentiality impact. The record does not name a fixed version. The only reference is a bounty report on huntr, and we did not fetch it. Check the project release notes for the version that fixes this and for anything that replaces the filter.
Weakness class: CWE-918 (server-side request forgery).
How to check if you're exposed
If you run anything-llm yourself, find out which version you have. For a Docker deployment:
docker ps --format "table {.Names} {.Image}"
docker inspect --format "{.Config.Image}" CONTAINER_NAME
Compare the image tag with the project releases. Then ask what that host can reach. A server that can fetch URLs can fetch anything its network allows, such as cloud metadata addresses, admin panels and databases on private ranges.
What to do now
- Update anything-llm to the newest release and read its notes for this bypass.
- Run the service in a network segment with no route to internal admin services or databases it does not need.
- Block requests from the host to cloud metadata addresses at the firewall or by using the provider's metadata protections.
- Do not rely on text filters for private addresses. Resolve the name, check the resulting address against a deny list, and connect only to that checked address.
- Review logs for outbound requests to private ranges that the product should not make.
Why it matters
Server-side request forgery turns a server into a proxy. The attacker supplies a URL and the server fetches it from inside the network, where it may have access that the attacker lacks. A filter that checks the text of an address is weak because one address can be written in many forms, such as decimal or hexadecimal numbers, or short forms that the network stack still accepts.
The lesson from this record is that a patch based on pattern matching can be bypassed. Fixes that resolve the address first and then compare it to a deny list hold up better. The KEV flag is false and the record does not claim exploitation in the wild.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why did the first fix fail?
The record says it filtered address text with regular expressions, and alternative address forms and other localhost ports still got through.
Which version fixes it?
The record does not say. Check the project release notes.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
