Bifrost's SSRF deny-list classifies CGNAT, 6to4 and NAT64 as public, so a multimodal URL reaches cloud metadata

GitHub Advisory Database·medium signalXBlueskyLinkedInCopy link

CVE-2026-55245, published 28 August against github.com/maximhq/bifrost/core, sits in isPublicIP, the deny-list that gates FetchAndEncodeURL when the gateway retrieves an image or document URL supplied in a Bedrock or Vertex request body. It permits Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated site-local (fec0::/10), all of which map onto internal infrastructure, including 6to4 and NAT64 embeddings of [redacted]. Notably the rest of the hardening is correct, with dial-time LookupIP pinning closing the DNS-rebinding TOCTOU and redirect targets re-validated, which makes this a range-coverage bug rather than a missing control.