PT-2026-85578

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the http fetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...