# SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresses

- **Severity:** High
- **Signature ID:** `345f44c1-2e56-48ba-972d-3569e87cfd96`
- **CVEs:** CVE-2026-42261
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM06 (Excessive Agency)

## Summary

Some AI agent tools that fetch URLs try to block requests to internal addresses like 127.0.0.1 or cloud metadata endpoints, but only check for the most common spellings. An attacker can rewrite the same address in an unusual but valid IPv6 form and slip past the filter to reach internal systems.

## How the attack works

An attacker gives an AI agent's URL-fetching tool a target address written as a non-standard IPv6 encoding of a loopback or internal address -- for example an IPv4-mapped hex form like ::ffff:7f00:1 instead of 127.0.0.1, a fully expanded form like 0:0:0:0:0:0:0:1, or a compressed variant like ::0:1 instead of ::1. The tool's private-address filter only recognizes the literal string '::1' or dotted-decimal IPv4-mapped addresses, so it does not normalize the address before checking it. The request goes through and the agent fetches content from loopback, internal RFC1918 ranges, link-local addresses, or a cloud metadata service that should have been blocked.

## Why it matters

An attacker can use the agent as a proxy into internal networks or cloud metadata services, potentially exposing internal service data, credentials, or cloud instance identity/role tokens.

## What you can do

- Normalize and fully parse IPv6 addresses (and IPv4-mapped IPv6 forms) before comparing against loopback/private/link-local ranges, rather than matching literal strings or dotted-decimal forms only.
- Use a well-tested IP address library to canonicalize addresses instead of custom regex or string-equality checks.
- Block outbound requests from agent tools to loopback, RFC1918, link-local, and cloud metadata ranges at the network layer as a second line of defense.
- Review any SSRF guard in agent tooling for the same class of bug: incomplete address normalization before filtering.

## Known benign look-alikes

- A networking engineer's documentation enumerating valid IPv6 loopback representations for reference, not an actual fetch-tool target
- An ordinary external IPv6 literal address in a URL (does not match any of the loopback/link-local/metadata forms above)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02193
- https://github.com/legeling/PromptHub/security/advisories/GHSA-9fhh-fjfg-5mr6
- https://github.com/legeling/PromptHub/releases/tag/v0.5.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-42261

---
Source: https://www.netzilo.com/threats/atr-ssrf-via-non-canonical-ipv6-encoding-of-loopback-internal-ad