# OpenMAIC 1.0.2 — three advisories close a DNS-rebinding SSRF

> A security release that pins OpenMAIC's media proxy to the addresses its own guard already approved.

- Org: THU-MAIC
- Date: 2026-09-13
- Category: security, tool, repo
- Source: https://github.com/THU-MAIC/OpenMAIC/releases/tag/v1.0.2
- Canonical page: https://ai-tldr.dev/releases/openmaic-1-0-2/

## In short

OpenMAIC 1.0.2 fixes three privately reported security holes in the open-source multi-agent classroom: two ways past the outbound URL guard on /api/proxy-media, and a route that let any caller overwrite an existing classroom.

## What it is

OpenMAIC 1.0.2 publishes three security advisories and ships their fixes in the same tag. Two are ways around the outbound URL guard on the /api/proxy-media route; the third let any caller overwrite an existing classroom file. OpenMAIC itself is an open-source multi-agent classroom that turns a topic or an uploaded document into an agent-taught lesson with slides, quizzes and narration.

## How it works

Both proxy holes are server-side request forgery. The first slipped an IP literal — the Alibaba Cloud metadata address 100.100.100.200 — past a denylist that was checked too late; metadata hostnames and addresses, including mapped and transition encodings, are now tested before the literal and local-network branches, in every environment. The second was DNS rebinding: the route validated a hostname, then let fetch() resolve it again at connect time, so a changing answer could steer the socket inward. A shared pinned dispatcher now connects only to addresses the guard validated, on every redirect hop. The classroom bug is fixed by generating ids server-side and creating files exclusively, returning 409 on a collision.

## Why it matters

Reaching a cloud metadata service from an unauthenticated request is the standard path to stealing instance credentials, so anyone self-hosting this classroom on a cloud VM has a reason to upgrade today rather than at leisure. The release also hardens billing: POST /api/generate/tts now inspects a 200 response before it stores or bills it, rejecting HTML, JSON and other non-audio bodies instead of trusting the status code.

## Who it's for

teams self-hosting OpenMAIC

## Try it

ALLOW_LOCAL_NETWORKS=true pnpm dev

## Quick facts

- Project: OpenMAIC (Open Multi-Agent Interactive Classroom)
- Maker: THU-MAIC
- Version: v1.0.2, released 13 September 2026
- Advisories fixed: 3 — two SSRF bypasses on /api/proxy-media, one classroom overwrite
- Breaking change: POST /api/classroom ignores a client-supplied stage.id
- New default: CGNAT range 100.64.0.0/10 blocked unless ALLOW_LOCAL_NETWORKS=true
- License: MIT

## FAQ

### What breaks when I upgrade OpenMAIC to 1.0.2?

Two defaults change in OpenMAIC 1.0.2. POST /api/classroom no longer honours a client-supplied stage.id, so callers must read the classroom id back from the response instead of choosing one. And the outbound URL guard now refuses CGNAT addresses in the 100.64.0.0/10 range by default, the same way it already refused private ranges.

### Does OpenMAIC 1.0.2 stop me reaching a local model server?

It can. OpenMAIC 1.0.2 blocks CGNAT addresses by default, which covers Tailscale-style overlay networks, so a model server or media host reached that way needs ALLOW_LOCAL_NETWORKS=true. Some ranges are refused whatever you set — IANA reserved, documentation, multicast and broadcast blocks such as 240.0.0.0/4, 198.18.0.0/15, 192.0.2.0/24 and 2001:db8::/32.

### Is there anything besides security fixes in OpenMAIC 1.0.2?

Yes. OpenMAIC 1.0.2 also adds GLM-5.3 and GLM-5.3-Flash, GenUI and Interactive component referencing during playback, a render queue preflight that runs before an export compiles, generated media written through the asset pool under server-backed persistence, and one JSON lifecycle event per render and preview transition on the render service.

### How does this compare with the OpenMAIC 1.0.1 security release?

The 1.0.1 release a week earlier fixed four advisories, one of them rated critical, including an unauthenticated SSRF whose guard ran only in production builds. OpenMAIC 1.0.2 fixes three more in the same area: the guard was still reachable around, once through a late-applied metadata denylist and once through DNS rebinding at connect time.

## Links

- [Release Notes](https://github.com/THU-MAIC/OpenMAIC/releases/tag/v1.0.2)
- [Repository](https://github.com/THU-MAIC/OpenMAIC)
- [Security Advisories](https://github.com/THU-MAIC/OpenMAIC/security/advisories)
- [Full Diff](https://github.com/THU-MAIC/OpenMAIC/compare/v1.0.1...v1.0.2)