CVE-2026-85692: Nightingale SSRF Vulnerability

CVE-2026-85692 Overview

CVE-2026-85692 is a server-side request forgery (SSRF) vulnerability [CWE-918] in Nightingale (n9e), an open-source observability platform. The flaw resides in the isPublicIP function in aiagent/tools/http.go, which serves as the SSRF guard for the http_fetch AI-agent tool. The guard only unwraps standard IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) before checking them against a forbidden-range list. It fails to classify 6to4 (2002::/16), NAT64 (64:ff9b::/96, 64:ff9b:1::/48), and deprecated site-local (fec0::/10) address formats. The issue is confirmed on the main branch at commit 8362cbe as of 2026-08-27.

Critical Impact
On dual-stack or NAT64-enabled hosts, attackers with access to the http_fetch tool can reach cloud instance-metadata endpoints such as 169.254.169.254 and exfiltrate credentials.

Affected Products

Nightingale (n9e) main branch at commit 8362cbe
Nightingale (n9e) version v9.1.1
Deployments exposing the http_fetch AI-agent tool on dual-stack or NAT64-enabled hosts

Discovery Timeline

2026-08-27 - Vulnerability confirmed on main branch at commit 8362cbe
2026-09-04 - CVE-2026-85692 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85692

Vulnerability Analysis

The http_fetch tool in Nightingale's AI agent accepts a URL from the caller and issues an outbound HTTP request. Before dispatching the request, isPublicIP in aiagent/tools/http.go resolves the hostname and compares the address against a blocklist of private, loopback, and link-local ranges. The guard unwraps IPv4-mapped IPv6 addresses of the form ::ffff:a.b.c.d, but stops there. Alternate IPv6 encodings that also route to sensitive IPv4 destinations are treated as arbitrary public addresses and allowed through.

Because the AI agent tool is designed to fetch remote content on behalf of a user, an attacker with authenticated access to the agent can direct outbound traffic at internal infrastructure. Reaching the cloud metadata service at 169.254.169.254 typically returns temporary credentials for the compute instance role, enabling lateral movement into the underlying cloud environment.

Root Cause

The root cause is incomplete IPv6 address normalization inside the SSRF allowlist logic. isPublicIP only handles the canonical IPv4-mapped prefix ::ffff::/96 and omits equivalence checks for 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and site-local (fec0::/10) representations. The embedded IPv4 octets inside these formats are never extracted or re-tested against the forbidden-range list.

Attack Vector

An authenticated attacker supplies a URL to the http_fetch tool whose hostname resolves to an IPv6 address encoding a forbidden IPv4 target. For the AWS metadata endpoint 169.254.169.254, the 6to4 form is 2002:a9fe:a9fe::. On a host with a NAT64 gateway or a dual-stack routing configuration, the outbound socket call reaches the internal IPv4 destination. The response, including instance metadata or internal API content, is returned to the attacker through the agent.

Full technical details are available in the VulnCheck SSRF Advisory and GitHub Issue #3363. The vulnerable source is published in the GitHub HTTP Tool Code.

Detection Methods for CVE-2026-85692

Indicators of Compromise

Outbound HTTP requests from Nightingale hosts to IPv6 addresses in 2002::/16, 64:ff9b::/96, 64:ff9b:1::/48, or fec0::/10.
Successful DNS resolutions for attacker-controlled hostnames returning AAAA records that encode private IPv4 space.
http_fetch audit entries containing URLs with bracketed IPv6 literals such as [2002:a9fe:a9fe::].
Unexpected access attempts against instance-metadata endpoints originating from the Nightingale service account.

Detection Strategies

Inspect Nightingale AI agent logs for http_fetch invocations whose target hostnames resolve to IPv6 addresses that decode to RFC 1918, loopback, or link-local IPv4 space.
Baseline normal outbound destinations for the Nightingale service and alert on first-seen IPv6 prefixes matching the 6to4 or NAT64 ranges.
Correlate cloud audit logs for calls to the instance-metadata service using the Nightingale instance role with any inbound AI-agent request.

Monitoring Recommendations

Enable egress logging on all Nightingale hosts and forward network flow data to a centralized analytics platform.
Enforce IMDSv2 on cloud instances so that any metadata request without a session token is rejected and logged.
Alert on any DNS query from Nightingale that returns an AAAA record within the vulnerable IPv6 prefixes.

How to Mitigate CVE-2026-85692

Immediate Actions Required

Disable the http_fetch AI-agent tool until a patched build is deployed.
Restrict outbound network access from Nightingale hosts to an allowlist of required destinations.
Enforce IMDSv2 on AWS instances and require hop-limit restrictions on the metadata service.
Rotate any credentials that may have been exposed through the instance-metadata endpoint.

Patch Information

At the time of publication, no fixed release is referenced in the advisory. Monitor the GitHub Nightingale Repository and GitHub Issue #3363 for a patched version. When a fix is released, isPublicIP should extract the embedded IPv4 octets from 6to4, NAT64, and site-local IPv6 encodings and re-evaluate them against the forbidden-range list before dispatching the request.

Workarounds

Disable IPv6 on Nightingale hosts where dual-stack connectivity is not required.
Remove any NAT64 gateway routes from the host network configuration.
Place Nightingale behind an egress proxy that denies requests to private IPv4 space regardless of the requested address family.
Deploy network policies that block traffic to 169.254.0.0/16 and RFC 1918 ranges from the Nightingale workload.

bash

# Configuration example: block metadata and private ranges at the host firewall
iptables -A OUTPUT -d 169.254.169.254 -j DROP
ip6tables -A OUTPUT -d 2002::/16 -j DROP
ip6tables -A OUTPUT -d 64:ff9b::/96 -j DROP
ip6tables -A OUTPUT -d 64:ff9b:1::/48 -j DROP
ip6tables -A OUTPUT -d fec0::/10 -j DROP