CVE-2026-55245

UNKNOWN 0.0

Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.

CWE	CWE-918
Vendor	maximhq
Product	bifrost
Published	Aug 28, 2026
Last Updated	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for maximhq bifrost

Be the first to know when new unknown vulnerabilities affecting maximhq bifrost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

maximhq / bifrost

< 1.5.17

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc github.com: https://github.com/maximhq/bifrost/pull/4092 github.com: https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89 github.com: https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17