Cloud-Metadata SSRF via Encoded Metadata-IP Bypass (CVE-2026-46678 / CVE-2026-25580 class)
AI agents that fetch URLs on a user's behalf can be tricked into contacting the cloud metadata service (169.254.169.254) even when a filter blocks that exact IP. Attackers disguise the address using IPv6 transition formats or plain integer/hex encoding, formats the operating system still resolves to the real metadata endpoint, and the agent's fetch call leaks short-lived cloud IAM credentials.
How the attack works
An attacker gives the agent a URL to fetch, disguising 169.254.169.254 as an IPv6 transition address (6to4, IPv4-mapped, or NAT64) or as a decimal/hex integer like 2852039166 or 0xa9fea9fe. A naive IP blocklist checks only for the literal dotted-quad string and lets the disguised value through. The operating system or network stack still routes the request to the real cloud metadata endpoint. The metadata service responds with temporary IAM credentials, which the agent returns in its fetch result, handing the attacker cloud access.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9f0d1f03-f0f8-4b9a-8113-0986b8ca5282
- Severity
- High
Why it matters
Successful exploitation gives the attacker valid short-lived cloud IAM credentials, which can be used to access or move laterally within the victim's cloud environment until the credentials expire or are revoked.
What you can do
- →Block outbound requests to 169.254.169.254 and its metadata-octet equivalent (a9fe:a9fe) at the network layer, not just via string matching in application code.
- →Normalize and fully resolve any URL or IP a user supplies before checking it against a blocklist — decode IPv6 transition forms and integer/hex IP notations first.
- →Restrict which hosts and ports agent fetch/URL tools are allowed to reach; use an allowlist instead of a blocklist where possible.
- →If using cloud instance metadata, require IMDSv2 (or the equivalent hardened token-based metadata API) so a bare GET request cannot retrieve credentials.
Known benign look-alikes
- Security training/research content that quotes the CVE-2026-46678 bypass payload as an example — intentional match; evaluate by context.
- Networking docs that legitimately show IPv6 transition syntax with a non-metadata address (rule keys on the a9fe:a9fe / 169.254.169.254 metadata octets specifically).