DataDog GuardDog contains a Server-Side Request Forgery (SSRF) vulnerability that could allow unauthenticated attackers to probe internal network resources.

The software is vulnerable to CWE-918 (SSRF), allowing an unauthenticated attacker to induce the application to make unauthorized requests to internal network segments or unauthorized services.

With a CVSS score of 8.2, this vulnerability poses a significant risk to internal infrastructure. Attackers may use this flaw to bypass firewalls, access internal metadata services, or perform reconnaissance on private network assets, potentially leading to deeper compromise of the environment.

Immediate Action: There is currently no fixed version available; users should monitor the official DataDog/guarddog GitHub repository for security updates and consider restricting the tool's network access.

Proactive Monitoring: Monitor egress traffic from the environment where GuardDog is running to identify attempts to reach internal endpoints that should not be accessible.

Compensating Controls: Implement strict egress filtering (e.g., via network security groups or firewall rules) to ensure the application cannot communicate with internal IP ranges or sensitive internal services.

Public Exploit Available: No (exploit_available: false)

Until a patch is released, users must implement network-level egress controls to mitigate the SSRF risk. Organizations should treat this vulnerability as urgent due to the potential for internal network exposure and the existence of a proof-of-concept.