CVE-2026-55245

Received Received - Intake

Bifrost AI Gateway Improper IP Address Validation

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55245

EUVD

EUVD-2026-67860

Affected Vendors & Products

Vendor	Product	Version / Range
maximhq	bifrost	to 1.5.17 (inc)
maximhq	bifrost	to 1.5.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Bifrost versions before 1.5.17. The isPublicIP function incorrectly classifies certain IP ranges as public when they should be blocked. This includes Carrier-Grade NAT ranges, IPv6 transition mechanisms like 6to4 and NAT64, and deprecated IPv6 site-local addresses. Attackers can exploit this to bypass SSRF protections and access internal services, including cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, check if your Bifrost instance is running a version prior to 1.5.17. Use commands like 'curl -s https://your-bifrost-instance/version' or inspect logs for SSRF-related connection attempts to internal IPs or metadata endpoints.

Impact Analysis

An attacker could exploit this to make the Bifrost gateway fetch internal services by crafting a malicious URL. This could lead to unauthorized access to sensitive internal endpoints, such as cloud instance metadata services, potentially exposing confidential data or enabling further attacks within your network.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Exposure of sensitive metadata or internal services may result in non-compliance with these regulations, leading to legal and financial penalties.

Mitigation Strategies

Upgrade Bifrost to version 1.5.17 or later immediately. This version includes fixes for SSRF bypass vectors by blocking CGNAT ranges, IPv6 transition mechanisms, and deprecated site-local addresses.

Review network logs for suspicious connections to internal IPs or metadata endpoints encoded in IPv6 formats like 6to4 or NAT64.
Ensure IP validation occurs at dial time and that redirects are validated similarly to initial requests to prevent DNS rebinding bypasses.

Hi! I’m here to help you understand CVE-2026-55245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70