Bifrost classifies CGNAT and NAT64 as public addresses.

CVE-2026-55245 sits in isPublicIP, the deny-list gating URL fetches when a Bedrock or Vertex request body supplies an image or document URL. It permits Carrier-Grade NAT (100.64.0.0/10), 6to4 (2002::/16), NAT64 (64:ff9b::/96) and deprecated site-local, all of which map onto internal infrastructure, including 6to4 and NAT64 embeddings of [redacted]. The rest of the hardening is correct, with dial-time LookupIP pinning closing the rebinding TOCTOU and redirects re-validated. It's a range-coverage bug in an otherwise well-built control, which is exactly how SSRF filters usually fail. (GitHub Advisory)