CVE-2026-55245

Bifrost, an enterprise AI gateway for routing requests to model providers, contains a high-severity server-side request forgery flaw (CWE-918, CVSS 4.0 8.7) in the isPublicIP function in core/providers/utils/fetch.go, which misclassifies Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated IPv6 site-local (fec0::/10) addresses as public. The flaw is reached through FetchAndEncodeURL when Bifrost handles image or document URLs for the Bedrock and Vertex providers, so a remote attacker who controls the URL supplied in a multimodal request can direct the gateway to fetch an attacker-chosen address while bypassing private-IP checks. Because these special-use ranges are treated as public, the attacker can make the gateway request internal services that would otherwise be blocked, including cloud instance metadata endpoints reached via 6to4 or NAT64 encodings. Deployments running Bifrost prior to 1.5.17 that use Bedrock or Vertex multimodal URL fetching are affected. There is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates a 0.4% probability of exploitation within 30 days, so exploitation is not currently known to be occurring; the fix is in version 1.5.17.

What to do: Upgrade Bifrost to version 1.5.17 or later. As an interim measure, restrict or disable user-supplied image/document URLs for Bedrock and Vertex requests, and validate or block URLs resolving to special-use ranges (100.64.0.0/10, 2002::/16, 64:ff9b::/96, 64:ff9b:1::/48, fec0::/10). Review gateway logs for requests to internal or cloud metadata endpoints (for example, 169.254.169.254 reached via 6to4 or NAT64 encodings) to check for prior probing.