CVE-2026-85692

Nightingale (n9e), as of commit 8362cbe on the main branch (confirmed 2026-08-27), contains a server-side request forgery (SSRF) guard bypass in the isPublicIP function (aiagent/tools/http.go), which is meant to keep the http_fetch AI-agent tool from reaching internal addresses. The function only unwraps standard IPv4-mapped (::ffff:a.b.c.d) IPv6 addresses before checking the forbidden-range list, so it does not classify 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), or deprecated site-local (fec0::/10) addresses as internal. A low-privileged attacker who can supply a URL to the http_fetch tool can, on a dual-stack or NAT64-enabled host, encode a forbidden IPv4 target such as the cloud instance-metadata endpoint 169.254.169.254 in one of these IPv6 forms and reach internal or metadata services (CVSS 4.0: 7.1 High, high confidentiality impact). Only deployments running the affected code where the http_fetch tool is available to untrusted users and where the host uses dual-stack or NAT64 networking are practically exposed. There is no known exploitation: no public PoC, not in CISA KEV, and EPSS is 0.3% (24th percentile).

What to do: Restrict the http_fetch AI-agent tool to trusted users and add egress filtering from the n9e host (particularly blocking 169.254.169.254 and internal ranges), or disable IPv6/NAT64 on that host's outbound path as interim mitigation. No fixed release is published yet, so track the upstream n9e repository and upgrade when a patched version lands; if building locally, extend isPublicIP to treat 2002::/16, 64:ff9b::/96, 64:ff9b:1::/48, and fec0::/10 as forbidden. Check http_fetch access and audit logs for URLs encoded in those IPv6 ranges as indicators of attempted bypass.