Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Bifrost's SSRF has a gap: isPublicIP includes CGNAT and other local IPs, making it risky for back-end systems. Builders should audit usage and check if you're affected by CVE-2026-55245. https://github.com/advisories/GHSA-w98g-5w9p-p3rc
Post summary
The advisory notes a gap in Bifrost's SSRF logic that allows CGNAT and local IP exposure, urging developers to audit usage for CVE-2026-55245.
🚨High - Bifrost SSRF via isPublicIP Deny-list Bypass (CVE-2026-55245) Bifrost core’s isPublicIP check used by FetchAndEncodeURL has an incomplete SSRF deny-list, allowing internal fetches via CGNAT, IPv6 6to4/NAT64, and deprecated IPv6 site-local ranges. An attacker controlling image/document URLs in Bedrock/Vertex requests can coerce the gateway to hit internal services incl. instance metadata via 6to4/NAT64 encoding. 👉Affected: http://github.com/maximhq/bifrost/core < 1.5.17 | Upgrade to 1.5.17
Post summary
The notification discloses a high‑severity SSRF flaw (CVE‑2026‑55245) in Bifrost core’s isPublicIP check and recommends upgrading to version 1.5.17 to remediate the issue.