SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses
Some AI agent tools that fetch URLs try to block requests to internal addresses like 127.0.0.1 or cloud metadata endpoints, but only check for the most common spellings. An attacker can rewrite the same address in an unusual but valid IPv6 form and slip past the filter to reach internal systems.
How the attack works
An attacker gives an AI agent's URL-fetching tool a target address written as a non-standard IPv6 encoding of a loopback or internal address -- for example an IPv4-mapped hex form like ::ffff:7f00:1 instead of 127.0.0.1, a fully expanded form like 0:0:0:0:0:0:0:1, or a compressed variant like ::0:1 instead of ::1. The tool's private-address filter only recognizes the literal string '::1' or dotted-decimal IPv4-mapped addresses, so it does not normalize the address before checking it. The request goes through and the agent fetches content from loopback, internal RFC1918 ranges, link-local addresses, or a cloud metadata service that should have been blocked.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 345f44c1-2e56-48ba-972d-3569e87cfd96
- Severity
- High
- CVEs
- CVE-2026-42261
Why it matters
An attacker can use the agent as a proxy into internal networks or cloud metadata services, potentially exposing internal service data, credentials, or cloud instance identity/role tokens.
What you can do
- →Normalize and fully parse IPv6 addresses (and IPv4-mapped IPv6 forms) before comparing against loopback/private/link-local ranges, rather than matching literal strings or dotted-decimal forms only.
- →Use a well-tested IP address library to canonicalize addresses instead of custom regex or string-equality checks.
- →Block outbound requests from agent tools to loopback, RFC1918, link-local, and cloud metadata ranges at the network layer as a second line of defense.
- →Review any SSRF guard in agent tooling for the same class of bug: incomplete address normalization before filtering.
Known benign look-alikes
- A networking engineer's documentation enumerating valid IPv6 loopback representations for reference, not an actual fetch-tool target
- An ordinary external IPv6 literal address in a URL (does not match any of the loopback/link-local/metadata forms above)