A high-severity Server-Side Request Forgery vulnerability in the Bifrost AI gateway allows unauthenticated remote attackers to bypass network restrictions and access sensitive internal metadata endpoints.

The application utilizes an insufficient blocklist in the isPublicIP function within core/providers/utils/fetch.go, which fails to correctly identify specific NAT and IPv6 address ranges as non-public. This flaw enables unauthenticated attackers to craft malicious multimodal request URLs that force the gateway to interact with internal services or cloud instance metadata endpoints.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive cloud environment data, including instance metadata, IAM credentials, or internal service configurations. With a CVSS score of 8.7, this represents a significant risk to organizational confidentiality and infrastructure security, as the attack vector is network-based and requires no authentication or user interaction.

Immediate Action: Update the Bifrost installation to version 1.5.17 or later immediately to incorporate the corrected IP address validation logic.

Proactive Monitoring: Review web access logs and egress traffic logs for suspicious requests directed toward internal metadata IP ranges, such as 169.254.169.254, or requests utilizing unusual IPv6 tunneling prefixes.

Compensating Controls: Implement strict egress filtering on the gateway host to prevent outbound requests to internal-only network segments, and configure a Web Application Firewall to block requests containing suspicious URL encoding or non-standard IP address formats.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for severe data exposure, organizations should prioritize patching Bifrost to version 1.5.17. Security teams must ensure that the gateway is isolated from sensitive internal segments using network-level controls, as this vulnerability demonstrates how easily application-layer flaws can bypass perimeter security.