Executive brief
Bifrost's gateway fetches remote images and documents for multimodal AI requests, but its IP filtering incorrectly permits several internal-use address ranges (CGNAT, IPv6 6to4/NAT64, site-local). An attacker can supply malicious image/document URLs that exploit these gaps to reach cloud instance-metadata endpoints or internal services that should be blocked, potentially exposing credentials and configuration.
Technical details
The isPublicIP function uses Go's netip helpers (IsLoopback, IsPrivate, IsLinkLocalUnicast, IsMulticast, etc.) to reject non-routable addresses, but has gaps: addr.IsPrivate() does not cover CGNAT (100.64.0.0/10, RFC 6598); addr.Unmap() only strips IPv4-mapped format (::ffff:0:0/96) and does not extract embedded IPv4 from 6to4 or NAT64 forms; and fec0::/10 (deprecated site-local) is not checked at all. An unauthenticated client supplies a remote URL in FetchAndEncodeURL (called from Bedrock and Vertex multimodal handlers), and the gate permits CGNAT, 6to4, NAT64, and site-local ranges to proceed to socket connection, enabling SSRF to internal services. The rest of the fetch hardening (DNS-rebinding closure, redirect validation, scheme filtering, 25 MiB cap, 20 s timeout) is correct. Fix requires extracting embedded IPv4 from IPv6 6to4/NAT64 forms and re-checking them, explicitly rejecting CGNAT, and blocking fec0::/10.
Affected products
- maximhq bifrost < 1.5.17
Timeline
- 2026-07-21: disclosed: GHSA initially published
- 2026-08-28: patched: Patched in version 1.5.17 (confirmed as of advisory update date)