SSRF URL Authority Confusion Bypass Targeting metadata.google.internal

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects attempts to access the GCP instance metadata service (metadata.google.internal) by exploiting Server-Side Request Forgery (SSRF) vulnerabilities. The rule looks for URI patterns often used to bypass filters by manipulating the authority component or using specific protocols like 'gcs://' to target internal cloud infrastructure.