# SSRF Scans Target Cloud Metadata Service for Credential Access

> Attackers are conducting widespread scans for Server-Side Request Forgery (SSRF) vulnerabilities to access cloud metadata services and retrieve sensitive IAM credentials.

- Published: 2026-08-19T16:24:58.000Z
- Severity: high
- Category: Threat Intel
- Tags: SSRF, Cloud Security, IAM, Credential Theft, Metadata Service
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/33260
- Canonical: https://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-access

## Key points

- Attackers are conducting widespread scans to exploit Server-Side Request Forgery against cloud metadata services.
- Cloud virtual machines with unhardened metadata services, particularly those not utilizing IMDSv2, are vulnerable to credential theft.
- Prioritize implementation of IMDSv2 and enforce strict network egress filtering to prevent unauthorized metadata service access.

## Overview: Widespread Scans Target Cloud Metadata Services

[Threat intelligence](/glossary#threat-intelligence) reports indicate a surge in widespread, generic scans targeting cloud metadata services. These scans are not specifically aimed at a single, known [vulnerability](/glossary#vulnerability), but rather represent a broad probing effort to identify Server-Side Request Forgery ([SSRF](/glossary#ssrf)) entry points that could grant access to critical cloud resources. The ultimate objective of these attacks is to compromise cloud-hosted virtual machines by retrieving sensitive credentials, such as AWS [IAM](/glossary#iam) role credentials and service account tokens, as detailed by [SANS Internet Storm Center](https://isc.sans.edu/diary/rss/33260).

## Understanding Cloud Metadata Services and SSRF Exploitation

Cloud metadata services are a fundamental component of virtualized cloud environments. Providers typically expose a REST [API](/glossary#api), most commonly at the link-local IPv4 address `169.254.169.254` (and `fd20:ce::254` for IPv6), which allows code running on a virtual machine (VM) to retrieve machine-specific data. This data can range from benign information like region and network configurations to highly sensitive assets such as temporary security credentials for IAM roles and service account tokens. The use of a link-local address is intentional; it is designed to be non-routable, meaning an external attacker cannot directly reach it from outside the VM.

However, attackers employ a "trick" to bypass this isolation: Server-Side Request Forgery (SSRF). An SSRF vulnerability allows an attacker to trick a vulnerable server-side application into making requests to an arbitrary URL, including internal, non-routable addresses like the metadata service. By leveraging SSRF, an attacker can coerce the compromised application to send requests to `http://169.254.169.254/latest/meta-data/iam/security-credentials/`, subsequently exfiltrating credentials that could grant broad access to cloud environments. A high-profile example of such exploitation assisting in a major data leak was the Capital One breach. The currently observed scans, often originating from `Go-http-client/1.1` user agents, are broadly attempting to **detect SSRF exploitation of 169.254.169.254** to find any vulnerable entry points.

## Actionable Recommendations for [Cloud Security](/glossary#cloud-security) [Hardening](/glossary#hardening)

Defending against these widespread scanning attempts and potential SSRF exploitation requires a multi-layered approach to cloud security. Prioritizing the hardening of cloud metadata service access is critical to **how to protect cloud metadata service from SSRF** attacks.

### Implementing IMDSv2 for Enhanced Security

Cloud providers have introduced more secure versions of their metadata services to mitigate SSRF risks. For AWS, this is Instance Metadata Service Version 2 (IMDSv2). IMDSv2 requires session-oriented requests, meaning a simple GET request is no longer sufficient. It mandates an initial PUT request to retrieve a session token, which must then be used in subsequent GET requests. This significantly complicates SSRF exploitation, making it "highly unlikely" for simple SSRF vulnerabilities to succeed. Organizations should actively work to **implement IMDSv2 for enhanced security** across all their AWS EC2 instances, ensuring that IMDSv1 is disabled wherever possible.

Additional mitigation strategies include:

*   **Network [Egress Filtering](/glossary#egress-filtering)**: Implement strict network security groups and NACLs to control outbound traffic from your instances. Ensure that instances can only connect to necessary external services and block all unauthorized outbound connections, especially to internal IP ranges that should not be accessed.
*   **[Least Privilege](/glossary#least-privilege) for IAM Roles**: Adhere strictly to the principle of least privilege when assigning IAM roles to EC2 instances. Grant only the necessary permissions for the application to function, reducing the potential impact if credentials are compromised.
*   **Web Application Firewalls (WAFs)**: Deploy WAFs in front of internet-facing applications to detect and block common web-based attacks, including SSRF attempts, before they can reach backend services.
*   **Runtime Monitoring**: Continuously monitor cloud environment logs, including VPC Flow Logs and AWS CloudTrail, for suspicious activity, unusual outbound connections, or unauthorized attempts to access metadata services. Look for unusual process execution or network connections from applications that should not be initiating them.

**Related:** [MLflow CVE-2026-64849 Exploited: Cloud Credential Theft Via SSRF](/blog/mlflow-cve-2026-64849-exploited-cloud-credential-theft-via-ssrf), [City-Forum Data Theft Targets Salesforce and ServiceNow Portals](/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portals)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-access