SSRF Internal Network and Private IP Range Access - ATR-2026-01606 (a2881092-e895-58ad-ba62-17ae6f8b7640)
Detects SSRF attempts targeting RFC-1918 private IP ranges (192.168.x.x, 10.x.x.x, 172.16-31.x.x) and internal hostnames (e.g., internal.*, admin.internal). When an agent's HTTP-fetch tool follows a URL pointing to internal infrastructure, it may expose admin panels, internal APIs, microservice endpoints, or cloud-internal management planes that are not accessible from the public internet. Attackers use this to pivot from the agent into the internal network.