CVE-2026-55245

Name of the Vulnerable Software and Affected Versions Bifrost versions prior to 1.5.17

Description Bifrost is an enterprise AI gateway for routing requests to model providers. A Server-Side Request Forgery (SSRF) issue exists because the isPublicIP() function in core/providers/utils/fetch.go incorrectly classifies several internal address ranges as public. Specifically, it fails to reject Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated IPv6 site-local (fec0::/10) addresses.

A remote attacker can exploit this by providing a malicious multimodal request URL in a Bedrock or Vertex request body. This allows the gateway to fetch internal services via the FetchAndEncodeURL function, including cloud instance metadata endpoints encoded through 6to4 or NAT64.

Recommendations Update Bifrost to version 1.5.17. As a temporary workaround, restrict the use of multimodal image or document URLs in requests to Bedrock and Vertex providers until the update is applied.