Which OpenMAIC versions are affected?

OpenMAIC 1.0.0 is the version the release notes tell people to upgrade from, and 1.0.1 is the fix. The four advisories were all reported privately before publication, and GitHub published them alongside the 1.0.1 tag on 6 September 2026. Older 0.3.x builds share the same code paths, so upgrading is the safe move.

What breaks if I upgrade OpenMAIC to 1.0.1?

OpenMAIC 1.0.1 tightens two defaults. Development builds now reject a client-supplied provider base URL on a loopback or private address, so a local Ollama or Lemonade endpoint needs ALLOW_LOCAL_NETWORKS=true. The development persistence authenticator now refuses to run under NODE_ENV=production unless PERSISTENCE_ALLOW_INSECURE_DEV_AUTH=true is set.

How serious is the critical OpenMAIC advisory?

GHSA-9m7h-vh2h-rc3w is rated critical because the outbound URL guard only ran in production builds, so a development or self-hosted build failed open. An unauthenticated request could be pointed at a cloud metadata service, the classic path to stealing instance credentials. The guard now runs everywhere and a repository-scanning test fails if a gated call site returns.

Is anything other than security in OpenMAIC 1.0.1?

Yes. OpenMAIC 1.0.1 also adds a fact-check skill, asynchronous generate_video, an Exa web-search provider, a POST /preview endpoint on the render service, double-click text insertion on the canvas, and deepseek-v4-flash-vision-exp in the DeepSeek catalog, plus faster classroom loading and around two dozen fixes.

THU-MAIC · 2026-09-06 · major

OpenMAIC 1.0.1 — four security advisories, one rated critical

OpenMAIC 1.0.1 fixes four privately reported security holes in the open-source multi-agent classroom, including a critical unauthenticated SSRF that could reach a cloud metadata service. Anyone running 1.0.0 should upgrade.

GitHub card for THU-MAIC/OpenMAIC, the open multi-agent interactive classroom

A patch release for the open-source multi-agent classroom that closes a critical SSRF and three other reported holes.

Quick facts

Project	OpenMAIC (Open Multi-Agent Interactive Classroom)
Maker	THU-MAIC, Tsinghua University
Version	v1.0.1, released 6 September 2026
Advisories fixed	4 — 1 critical, 2 high, 1 medium
Highest severity	GHSA-9m7h-vh2h-rc3w, unauthenticated outbound SSRF
New requirement	Node 22.19 or newer (was 20.9)
License	MIT

What is it?

OpenMAIC 1.0.1 is a security and stability release that fixes four privately reported vulnerabilities, published as GitHub advisories on the same day. One is rated critical, two high and one medium. OpenMAIC itself is a Tsinghua-built open-source app that turns a topic or an uploaded document into an interactive lesson, with agent teachers, slides, quizzes, narration and a shared whiteboard.

How does it work?

The critical bug was a fail-open guard: the outbound URL check only ran in production builds, so other builds would follow a request to a cloud metadata service. The path-traversal bug let a stage id escape the classrooms directory on write, because the read path validated the id and the write path did not. Slide HTML was rendered through dangerouslySetInnerHTML without sanitizing; it is now cleaned once at the persistence boundary. Provider redirects are re-checked on every hop, and credential headers are dropped on a cross-origin hop.

Why does it matter?

Self-hosted AI apps like OpenMAIC take a user-supplied model base URL and fetch remote content by design, which makes them a natural home for server-side request forgery. A guard that runs only in production is worse than no guard, because the deployments most likely to be exposed are the quick self-hosted ones. With 32,000 stars, the number of running instances is large enough that a public critical advisory matters.

Who is it for?

anyone self-hosting OpenMAIC

Frequently asked questions

Which OpenMAIC versions are affected?: OpenMAIC 1.0.0 is the version the release notes tell people to upgrade from, and 1.0.1 is the fix. The four advisories were all reported privately before publication, and GitHub published them alongside the 1.0.1 tag on 6 September 2026. Older 0.3.x builds share the same code paths, so upgrading is the safe move.
What breaks if I upgrade OpenMAIC to 1.0.1?: OpenMAIC 1.0.1 tightens two defaults. Development builds now reject a client-supplied provider base URL on a loopback or private address, so a local Ollama or Lemonade endpoint needs ALLOW_LOCAL_NETWORKS=true. The development persistence authenticator now refuses to run under NODE_ENV=production unless PERSISTENCE_ALLOW_INSECURE_DEV_AUTH=true is set.
How serious is the critical OpenMAIC advisory?: GHSA-9m7h-vh2h-rc3w is rated critical because the outbound URL guard only ran in production builds, so a development or self-hosted build failed open. An unauthenticated request could be pointed at a cloud metadata service, the classic path to stealing instance credentials. The guard now runs everywhere and a repository-scanning test fails if a gated call site returns.
Is anything other than security in OpenMAIC 1.0.1?: Yes. OpenMAIC 1.0.1 also adds a fact-check skill, asynchronous generate_video, an Exa web-search provider, a POST /preview endpoint on the render service, double-click text insertion on the canvas, and deepseek-v4-flash-vision-exp in the DeepSeek catalog, plus faster classroom loading and around two dozen fixes.

Try it

git pull && pnpm install && pnpm build  # requires Node 22.19+