Server-Side Request Forgery Vulnerability in Nightingale by CCFOS

CVE-2026-85692

What is CVE-2026-85692?

Nightingale, specifically in its main branch as of commit 8362cbe (dated August 27, 2026), has been identified to contain a server-side request forgery vulnerability. This flaw is found in the isPublicIP function within the aiagent/tools/http.go file, which acts as a guard for the http_fetch AI-agent tool. The issue arises because this function inadequately unpacks IPv4-mapped IPv6 addresses while omitting the validation of certain IPv6 address types like 6to4, NAT64, and deprecated site-local addresses. An attacker able to manipulate the encoding of forbidden IPv4 addresses into these unsupported IPv6 formats can potentially use the http_fetch tool to bypass security measures, thereby accessing sensitive internal or cloud instance metadata services.

References