Server-side request forgery

How SSRF works

SSRF starts when software gets an external URL and fetches it. The server sends the request from its own network position. OWASP says the request can go through a firewall, a VPN or a network access control list.

The usual targets, from OWASP A10:2021 and the MCP security best practices:

• Cloud metadata at 169.254.169.254, which can give cloud credentials.
• Localhost services, such as Redis on port 6379.
• Internal admin pages and APIs on private ranges such as 10.0.0.0/8.
• Local files through schemes such as file:///etc/passwd.
• Port scans of the internal network, from the time or error of each reply.

Why SSRF is a risk for AI systems

AI systems fetch URLs from text that nobody checked. The attacker does not change code. A prompt injection can supply the URL, as CVE-2023-32786 shows for LangChain through 0.0.155.

OWASP put SSRF in its Top 10 in 2021, as number one in its community survey. In the 2025 list, CWE-918 is one of the CWEs mapped to A01:2025 Broken Access Control.

In practice: SSRF in AI tools

Four records show where the vulnerability is in AI software.

CVE	Product	Part that fetches	Score
CVE-2023-32786	LangChain through 0.0.155	prompt injection makes the service fetch a URL	none given
CVE-2024-3095	LangChain 0.1.5	Web Research Retriever	CVSS 3.0: 4.8
CVE-2025-65513	fetch-mcp 1.0.2 and before	private IP check can be bypassed	CVSS 3.1: 7.5 (CISA-ADP)
CVE-2026-33626	LMDeploy before 0.12.3	image loader of the vision-language module	CVSS 3.1: 7.5

The MCP specification (version 2025-11-25) shows a fifth position. During OAuth metadata discovery, an MCP client fetches URLs from an MCP server. A malicious server can give internal URLs. The specification says: “The MCP client acts as a proxy, bypassing network perimeter controls.”

6 controls against SSRF, and what does not work

The OWASP cheat sheet gives two conditions. If the software calls only known services, use an allow list. A web tool for an agent must fetch each URL on the internet. Then use the other controls too.

1. Use an allow list for the scheme, port and destination where possible (OWASP).
2. Check the resolved IP address, then connect to that same address. A domain allow list alone does not stop DNS rebinding (OWASP cheat sheet).
3. Do not follow redirects without a check. Check each hop with the same rules (MCP specification).
4. Send outbound requests through an egress proxy that blocks internal ranges. The MCP specification names Smokescreen from Stripe.
5. Use IMDSv2 on AWS. It requires a session token from a PUT request. AWS says this stops “the vast majority” of SSRF vulnerabilities. OWASP calls it defence in depth for “some” conditions.
6. Do not send raw responses to the client. Also put the functions that fetch remote resources in a separate network segment, behind a deny-by-default firewall (OWASP).

A least privilege network for the fetch tool limits the damage if one of these controls does not work.

Questions and answers

How is SSRF a risk for AI agents and LLM apps?

Many AI tools fetch URLs: web retrievers, image loaders in vision models, MCP fetch tools and MCP clients. If the tool does not check the destination, an attacker can send it to internal addresses. In LangChain through 0.0.155, prompt injection made the service fetch an arbitrary URL (CVE-2023-32786). The attacker did not change the code.

Is a deny list of internal IP addresses enough to stop SSRF?

No. OWASP says deny lists and regular expressions are not sufficient. The MCP specification warns that attackers use octal, hex and IPv4-mapped IPv6 formats of an address. DNS rebinding and redirects also go around a check of the URL text. Check the resolved IP address, then connect only to that address.

Is SSRF still in the OWASP Top 10?

SSRF was its own category, A10, in the OWASP Top 10 2021. In the 2025 edition, CWE-918 SSRF is one of the CWEs mapped to A01:2025 Broken Access Control.