Double-Slash SSRF Injection in URL Parameter Targeting GCP Metadata Endpoint

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects attempts to bypass URL validation and access sensitive GCP metadata endpoints (169.254.169.254 or metadata.google.internal) using a double-slash (//) prefix injection pattern within URL parameters. This technique is often used in Server-Side Request Forgery (SSRF) attacks to read local resources or metadata credentials from Cloud Run or other GCP compute services.