Description

Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the http_fetch AI-agent tool. The function only unwraps standard IPv4-mapped (::ffff:a.b.c.d) IPv6 addresses before checking them against the forbidden-range list, and does not classify 6to4 (2002::/16), NAT64 (64:ff9b::/96, 64:ff9b:1::/48), or deprecated site-local (fec0::/10) addresses. On a dual-stack or NAT64-enabled host, an attacker able to supply a URL to the http_fetch tool can bypass the guard by encoding a forbidden IPv4 address (such as the cloud instance-metadata endpoint 169.254.169.254) in one of these IPv6 forms to reach internal or metadata services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:47.243Z",
  "pubdate": "2026-09-04T15:17:47.243Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability exists in Nightingale (n9e) commit 8362cbe due to an incomplete blocklist implementation in the isPublicIP function.\nThe vulnerability resides within the http_fetch AI-agent tool, which fails to adequately sanitize specific IPv6 address formats when validating target URLs.\nBy leveraging 6to4, NAT64, or site-local IPv6 address representations, an attacker can bypass existing security controls designed to restrict access to internal network resources and sensitive metadata endpoints.\nThe risk is significant for cloud-deployed instances where access to the instance-metadata service (169.254.169.254) is critical to infrastructure security.\nSuccessful exploitation allows a remote attacker to perform unauthorized HTTP requests against internal services that are otherwise protected from the public internet.\nThis vulnerability is particularly potent in dual-stack or NAT64-enabled network environments, potentially leading to unauthorized data exfiltration, service discovery, or credential theft from metadata services.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient validation logic within the isPublicIP function located in aiagent/tools/http.go. The function is designed to act as an SSRF guard for the http_fetch tool by verifying that requested destination IP addresses do not fall within forbidden ranges (e.g., private or loopback networks).\nCurrently, the implementation exclusively unwraps IPv4-mapped IPv6 addresses (::ffff:a.b.c.d). While this correctly handles standard mapped addresses, the logic fails to account for other valid IPv6 representations that can be used to resolve to forbidden IPv4 addresses or reserved IPv6 segments.\nSpecifically, the check ignores 6to4 (2002::/16), NAT64 (64:ff9b::/96, 64:ff9b:1::/48), and deprecated site-local (fec0::/10) prefixes. In dual-stack environments or networks utilizing NAT64 gateways, an attacker can craft a payload URL that represents an internal IPv4 address using one of these unvalidated IPv6 formats.\nThe attack flow proceeds as follows: 1) The attacker provides a URL to the http_fetch tool containing an IPv6 address that maps to an internal resource. 2) The isPublicIP function parses the address but fails to recognize the target as forbidden because the prefix is not in the explicit blocklist. 3) The validation check returns a false negative, allowing the request to proceed. 4) The underlying HTTP client resolves the address through the system network stack. 5) In a NAT64 environment, the gateway translates the request, allowing the attacker to reach restricted internal services like the instance-metadata endpoint.\nThis vulnerability does not require authentication to the target internal service, as the request is performed by the Nightingale server itself. If the AI-agent tool is exposed to untrusted input, the attacker can leverage the server as a proxy to bypass firewall rules and access sensitive internal services, perform reconnaissance, or potentially exfiltrate metadata tokens necessary for cloud-based lateral movement."
}