SSRF GCP Metadata Access via Web App Spawning curl/wget/python

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.