Bifrost, the enterprise AI gateway, allowed the isPublicIP function to incorrectly classify several private address families—such as Carrier‑Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16, NAT64 64:ff9b::/96, 64:ff9b:1::/48, and deprecated site‑local fec0::/10—as public addresses. Consequently, when the gateway’s FetchAndEncodeURL routine processes multimodal request URLs for Bedrock or Vertex image or document endpoints, it can inadvertently reach internal services. A remote attacker who supplies a crafted multimodal request URL can exploit this misclassification to make the gateway query internal resources, including cloud instance metadata endpoints, and gain sensitive information or elevate privileges. This flaw is a classic SSRF vulnerability, identified as CWE‑918.

The vulnerability exists in the maximhq Bifrost product across all prior releases before core version 1.5.17. Administrators using versions 1.5.16 or earlier, regardless of deployment environment, are susceptible. The affected component is core/providers/utils/fetch.go, which is invoked by the FetchAndEncodeURL feature that handles third‑party image and document URLs from Bedrock and Vertex services.

The CVSS score of 8.7 marks this issue as high severity, and the EPSS information is currently unavailable, indicating no data on exploit frequency. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by supplying a multimodal request with a target URL encoded in a 6to4 or NAT64 format, which is typically controllable over the public internet. Because the flaw relies on input supplied by an external user, it can be abused remotely without additional privileges, making it a significant risk for organizations that expose Bifrost to untrusted clients.