GCP Cloud Run SSRF to metadata.google.internal Metadata Server

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects web requests containing patterns indicative of Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) Instance Metadata API (metadata.google.internal). The rule monitors for attempts to access metadata endpoints, including token retrieval paths.