CVE-2026-55245: Bifrost AI Gateway SSRF Vulnerability

CVE-2026-55245 Overview

CVE-2026-55245 is a Server-Side Request Forgery (SSRF) vulnerability in Bifrost, an enterprise AI gateway that routes requests to model providers. The flaw affects versions prior to 1.5.17 and resides in the isPublicIP function in core/providers/utils/fetch.go. The function fails to classify several address ranges as internal, including Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated IPv6 site-local (fec0::/10). Attackers who control a multimodal request URL for Bedrock or Vertex image or document processing can force the gateway to fetch internal services, including cloud instance metadata endpoints.

Critical Impact
A remote unauthenticated attacker can exfiltrate cloud instance metadata credentials and reach internal services by smuggling IPv4 targets inside IPv6 transition addresses.

Affected Products

Bifrost AI Gateway versions prior to 1.5.17
Deployments processing Amazon Bedrock multimodal requests
Deployments processing Google Vertex image or document URLs

Discovery Timeline

2026-08-28 - CVE-2026-55245 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55245

Vulnerability Analysis

Bifrost exposes an image and document fetching path through FetchAndEncodeURL, invoked when routing Bedrock or Vertex multimodal requests. The gateway attempts to block SSRF by validating destination IP addresses against private, loopback, and link-local ranges. The isPublicIP allowlist logic is incomplete and treats several sensitive address ranges as public.

An attacker submits a request containing a URL whose hostname resolves to a permitted range such as an IPv6 6to4 address. The gateway dials the destination and returns the response content encoded into the multimodal payload. This enables retrieval of the cloud instance metadata service, unauthenticated internal APIs, and other backend services reachable from the gateway host. This vulnerability is classified under CWE-918: Server-Side Request Forgery.

Root Cause

The isPublicIP function omits checks for Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 well-known prefixes (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated IPv6 site-local addresses (fec0::/10). IPv6 transition mechanisms embed IPv4 addresses inside IPv6 representations, which lets attackers reach internal IPv4 targets by encoding them as 2002:: or 64:ff9b:: addresses that bypass the IPv4 private-range checks.

Attack Vector

Exploitation requires network access to the Bifrost API and the ability to submit a multimodal request referencing an attacker-chosen URL. No authentication or user interaction is required. A representative payload is a Bedrock or Vertex request whose image field points to a 6to4-encoded metadata endpoint such as http://[2002:a9fe:a9fe::]/latest/meta-data/iam/security-credentials/, which corresponds to 169.254.169.254.

 // deadlines; pass context.Background() if no request context is available.
 //
 // SSRF-hardened: only http/https schemes are accepted, and the dialer rejects
-// connections to loopback, private, link-local, unique-local, and unspecified
-// addresses. The IP check runs at dial time (not just lookup time) so DNS
-// rebinding does not bypass it. Redirect targets are subject to the same
+// connections to loopback, private, CGNAT, link-local, unique-local, site-local,
+// and unspecified addresses (including IPv4 targets smuggled inside IPv6
+// transition addresses). The IP check runs at dial time (not just lookup time)
+// so DNS rebinding does not bypass it. Redirect targets are subject to the same
 // scheme + dial-time IP validation.
 func FetchAndEncodeURL(ctx context.Context, resourceURL string) (mediaType string, encoded string, err error) {
 	const maxBytes int64 = 25 * 1024 * 1024

Source: GitHub Commit 54ec431 — the patch expands the dialer's blocklist to include CGNAT, site-local, and IPv6 transition ranges.

Detection Methods for CVE-2026-55245

Indicators of Compromise

Outbound connections from the Bifrost host to 169.254.169.254, metadata.google.internal, or fd00:ec2::254 shortly after multimodal API calls.
Multimodal request bodies containing URLs with hostnames in 100.64.0.0/10, 2002::/16, 64:ff9b::/96, 64:ff9b:1::/48, or fec0::/10.
Bifrost logs showing successful FetchAndEncodeURL calls that return non-image content types or payloads consistent with metadata responses.

Detection Strategies

Inspect Bifrost application logs for URL fetches whose resolved IP falls inside the address ranges patched in 1.5.17.
Correlate multimodal API request rates with spikes in egress traffic to link-local metadata IPs on cloud workloads.
Deploy an egress proxy or IMDSv2-only configuration and alert on any IMDSv1 access attempts originating from the gateway.

Monitoring Recommendations

Enable cloud flow logs (VPC Flow Logs, Azure NSG Flow Logs, GCP VPC Flow Logs) on the Bifrost workload subnet and alert on egress to 169.254.169.254 and equivalent IPv6 metadata endpoints.
Log the full URL of every FetchAndEncodeURL invocation and hash-match against the impacted CIDR blocks.
Monitor STS or IAM credential usage tied to the gateway's instance role for unexpected source IPs or API call patterns.

How to Mitigate CVE-2026-55245

Immediate Actions Required

Upgrade Bifrost core to version 1.5.17 or later on every deployed instance.
Enforce IMDSv2 with hop-limit of 1 on AWS EC2 instances hosting Bifrost to block SSRF-based metadata theft.
Rotate any IAM role credentials, service account tokens, or API keys reachable from the gateway host if exploitation is suspected.

Patch Information

The fix is delivered in Bifrost core v1.5.17, tracked as GitHub Security Advisory GHSA-w98g-5w9p-p3rc and merged via Pull Request #4092. The patched isPublicIP function rejects CGNAT, site-local, and IPv6 transition addresses at dial time so DNS rebinding cannot bypass the check. Release notes are published at GitHub Release core/v1.5.17.

Workarounds

Place Bifrost behind an egress firewall or proxy that denies traffic to 169.254.169.254, fd00:ec2::254, metadata.google.internal, and all RFC1918, CGNAT, and IPv6 transition ranges.
Disable multimodal Bedrock and Vertex request handling until the upgrade is applied if patching is not immediately possible.
Deploy the gateway in a network segment that has no route to internal management interfaces or cloud metadata services.

bash

# AWS: enforce IMDSv2 and reduce hop-limit to block SSRF-based metadata access
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

# Upgrade Bifrost core to the patched release
go get github.com/maximhq/bifrost/core@v1.5.17