{"action":"Upgrade github.com/maximhq/bifrost/core to 1.5.17 or later.","affected":[{"fixed":"1.5.17","introduced":"0"}],"component":"github.com/maximhq/bifrost/core","cve_ids":["CVE-2026-55245"],"ecosystem":"Go","epss":0.00611,"exploited":false,"fixed_versions":["1.5.17"],"ghsa_id":"GHSA-w98g-5w9p-p3rc","id":"tcs_01M5KFQHXZVVWENQ2M4HZ9VG5K","modified_at":"2026-09-02T19:55:46.494426956Z","published_at":"2026-08-28T18:26:02Z","references":["https://osv.dev/vulnerability/GHSA-w98g-5w9p-p3rc","https://github.com/maximhq/bifrost/security/advisories/GHSA-w98g-5w9p-p3rc","https://github.com/maximhq/bifrost/pull/4092","https://github.com/maximhq/bifrost/commit/54ec431fc5255ff42c36420d88549477e0b33d89","https://github.com/maximhq/bifrost","https://github.com/maximhq/bifrost/releases/tag/core/v1.5.17"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-w98g-5w9p-p3rc","url":"https://osv.dev/vulnerability/GHSA-w98g-5w9p-p3rc"},{"source":"nvd","source_id":"CVE-2026-55245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55245"}],"summary":"Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL"}