title: SSRF Internal Network and Private IP Range Access
id: ATR-2026-01606
rule_version: 1
status: experimental
description: |
  Detects SSRF attempts targeting RFC-1918 private IP ranges
  (192.168.x.x, 10.x.x.x, 172.16-31.x.x) and internal hostnames
  (e.g., internal.*, admin.internal). When an agent's HTTP-fetch
  tool follows a URL pointing to internal infrastructure, it may
  expose admin panels, internal APIs, microservice endpoints, or
  cloud-internal management planes that are not accessible from the
  public internet. Attackers use this to pivot from the agent into
  the internal network.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM02:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1090 - Proxy
compliance:
  owasp_llm:
    - id: LLM02:2025
      context: SSRF to internal IPs allows access to services not exposed publicly, potentially leaking configuration and credentials.
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Detection of internal-network SSRF supports MEASURE 2.7 security evaluation.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: Article 15 requires robustness against adversarial inputs; SSRF probing private and link-local IP ranges to reach services not exposed publicly is a high-severity adversarial vector.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under Clause 8.1 must detect and block agent tool inputs containing private or link-local IP ranges used to scan and reach internal services beyond the intended data scope.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) requires risk treatment of known attack patterns; detecting internal-network SSRF that leaks internal service configuration and credentials is such a treatment.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: ssrf
  scan_target: tool_args
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)https?://(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3})(?::\d+)?/(?:admin|_cluster|_cat|_nodes|v1/kv|v1/secret|metadata|computeMetadata|latest/meta-data|actuator|console|\.env|config|debug|internal)\b
      description: Fetch tool arg targets an RFC-1918 private IP on a sensitive internal path (admin/metadata/datastore/config)
    - field: tool_args
      operator: regex
      value: (?i)https?://(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}):(?:9200|9300|8500|2379|6379|27017|3306|5432|8086|2375|10250)\b
      description: Fetch tool arg targets an RFC-1918 private IP on a well-known internal datastore/control-plane port
    - field: user_input
      operator: regex
      value: (?i)\b(?:fetch|retrieve|get|access|load|read|request|curl|wget|hit|query|scan|connect\s+to|pull)\b[^\n]{0,60}?https?://(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}):(?:9200|9300|8500|2379|6379|27017|3306|5432|8086|2375|10250)\b
      description: 'User directs the agent to fetch/retrieve from an RFC-1918 private IP on a well-known internal datastore/control-plane port (SSRF pivot intent). Requires a sensitive target, mirroring the tool_args conditions: a bare private-IP URL with no internal port is not matched, because in prose it is indistinguishable from homelab and lab-build documentation — an HTTPS setup guide tripped the unqualified form on a fenced ''curl -kv https://192.168.1.1''. The sensitive-path half of this channel is covered by the next condition'
    - field: user_input
      operator: regex
      value: (?i)https?://(?:192\.168\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3})(?::\d+)?/(?:admin|_cluster|_cat|_nodes|v1/kv|v1/secret|metadata|computeMetadata|latest/meta-data|actuator|console|\.env|config|debug|internal)\b
      description: User input contains a private-IP URL on a sensitive internal path (admin/metadata/datastore/config)
  condition: any
  false_positives:
    - Agents operating within a private network explicitly authorized to query internal services
    - Network monitoring agents with approved internal scan permissions
response:
  actions:
    - block_tool
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01606] SSRF to internal network detected. Request targets
    private IP range. Tool call blocked.
confidence: 88