Callback-url-http-3a-2f-2f169.254.169.254-2flatest-2fmeta Data-2fiam-2fsecurity Credentials-2f May 2026

After URL decoding, this string translates to:

callback-url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ An attacker changes the URL to:

This is not an ordinary web address. The IP 169.254.169.254 is a link-local address reserved exclusively for the AWS Instance Metadata Service (IMDS) . This service provides EC2 instances with internal data, most critically the temporary IAM role credentials used by applications to authenticate with AWS APIs. If the app’s backend makes the request without

The specific path /latest/meta-data/iam/security-credentials/ is used to retrieve temporary security credentials for the IAM role attached to an EC2 instance. These credentials are short-lived and can be used by applications running on the instance to access AWS resources securely without needing to hard-code or store long-term AWS access keys. While this mechanism is incredibly convenient

The most common way to access this URL from outside the instance is through a Server-Side Request Forgery (SSRF) vulnerability. For example:

An attacker changes the URL to:

If the app’s backend makes the request without proper filtering, the response will leak the instance’s IAM role names and, with a second request, the actual credentials.

While this mechanism is incredibly convenient, the IP address 169.254.169.254 has become infamous in the cybersecurity world due to Server-Side Request Forgery (SSRF).