Executive brief
Nightingale is an open-source monitoring and alerting platform. The http_fetch AI-agent tool is vulnerable to server-side request forgery (SSRF) attacks, allowing attackers to bypass IP address filtering and access restricted internal services like cloud instance-metadata endpoints. An attacker who can supply URLs to the tool can reach internal systems or steal sensitive metadata by encoding forbidden addresses in alternative IPv6 formats.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the isPublicIP function (aiagent/tools/http.go), which guards the http_fetch AI-agent tool against accessing private/restricted IP addresses. The vulnerable function only unwraps standard IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) before validation, but fails to recognize equivalent representations such as 6to4 (2002::/16), NAT64 (64:ff9b::/96, 64:ff9b:1::/48), or deprecated site-local (fec0::/10) address blocks. An attacker with the ability to provide URLs to the http_fetch tool can encode a forbidden IPv4 address (e.g., 169.254.169.254, the AWS metadata endpoint) in one of these alternative IPv6 forms to bypass the guard. On dual-stack or NAT64-enabled hosts, this allows access to internal services or cloud metadata. A patch should implement complete IPv6 address normalization and validation against all reserved/private ranges.
Affected products
- ccfos Nightingale v9.1.1 and prior (as of commit 8362cbe on main branch)
Timeline
- 2026-09-04: disclosed: CVE-2026-85692 published
- 2026-08-27: other: Vulnerability confirmed in main branch commit 8362cbe