SSRF to Cloud Metadata Endpoint via IPv6 Transition-Address Hex Encoding
An AI agent that fetches URLs or uses a web-crawling tool can be tricked into reaching the cloud metadata service even when a security filter blocks the well-known metadata IP address. The trick is writing that blocked address using IPv6 'transition' encodings instead of plain dotted-decimal, so the filter never recognizes it.
How the attack works
An attacker supplies a proxy, fetch, or crawl configuration containing a URL or hostname that is not the plain IP 169.254.169.254 (or Alibaba's 100.100.100.200) but the same address encoded as an IPv6 NAT64 address (64:ff9b::a9fe:a9fe), a 6to4 address (2002:a9fe:a9fe::), or an IPv4-mapped/compatible IPv6 form (::a9fe:a9fe or ::ffff:a9fe:a9fe). A blocklist that only checks for the literal dotted-decimal string lets this request pass. The agent's HTTP client or crawler then resolves the address and connects to the cloud metadata endpoint. From there the attacker can read instance credentials, tokens, or other metadata normally reachable only from inside the host.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b085ceea-9617-477e-ab7e-40294db89b97
- Severity
- High
- CVEs
- CVE-2026-53754
Why it matters
Successful exploitation exposes cloud instance credentials or metadata, which can lead to full account or infrastructure takeover depending on the cloud provider and IAM role attached to the instance.
What you can do
- →Block outbound requests to metadata IPs by parsing and normalizing the destination address (resolve any IPv6 form to its embedded IPv4 equivalent) before applying the blocklist, rather than doing literal string matching.
- →Deny all agent/tool network egress to link-local and metadata ranges at the network layer (e.g. via a firewall or proxy that enforces this independent of application code).
- →Disable IMDSv1 where possible and require IMDSv2 or equivalent token-based metadata access so a bare SSRF request can't retrieve credentials.
- →Review any crawler, fetch, or proxy tool used by your agents for how it validates destination hosts, and test it against NAT64/6to4/IPv4-mapped encodings of your sensitive internal addresses.
Known benign look-alikes
- A legitimate, unrelated IPv6 address that happens to contain similar-looking hex groups without the specific NAT64 (64:ff9b::) or 6to4 (2002:) prefix and without proxy/server/host field context
- Documentation or defensive code that blocks these specific transition-address forms by name (should be reviewed for context, not auto-allowlisted, since the same string appears in both attack and defense)