THREAT OPS › Threat News › [GHSA] GHSA-w98g-5w9p-p3rc (high) — Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
[GHSA] GHSA-w98g-5w9p-p3rc (high) — Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
GHSA-w98g-5w9p-p3rc Severity: high CVE: CVE-2026-55245
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
## Summary
`isPublicIP` in `core/providers/utils/fetch.go` — the SSRF deny-list that gates `FetchAndEncodeURL` — does not reject several routable address ranges that map onto internal infrastructure. Carrier-Grade NAT (`100
Indicators of compromise
- f415c144678bd4b411d74a1c1f85f18652833224sha1
- CVE-2026-55245cve
- CVE-2026-45741cve
- http://100.64.1.1:9/url
- http://100.127.255.254:9/url
- http://169.254.169.254:9/url
- http://10.0.0.1:9/url
- http://127.0.0.1:9/url
- 100.64.0.0ipv4
- 100.64.1.1ipv4
- 100.127.255.254ipv4
- 100.64.0.1ipv4
- 8.8.8.8ipv4
- 100.64.0.0/10cidr
Original source: https://github.com/advisories/GHSA-w98g-5w9p-p3rc