{"record":{"id":"6cfde2df3e0c0961","repo":"conductor-oss/conductor","slug":"access-denied-loopback-address-is-blocked-host-r","errorCode":null,"errorMessage":"Access denied: loopback address is blocked (host resolves to {address})","messagePattern":"Access denied: loopback address is blocked \\(host resolves to (.+?)\\)","errorType":"validation","errorClass":"DocumentAccessDeniedException","httpStatus":null,"severity":"critical","filePath":"ai/src/main/java/org/conductoross/conductor/ai/document/DocumentAccessPolicy.java","lineNumber":364,"sourceCode":"        // rebinding because InetAddress.getByName normalizes all representations.\n        checkResolvedAddress(host);\n    }\n\n    /**\n     * Resolves the host to an IP address and blocks link-local (169.254.0.0/16) and other dangerous\n     * ranges that are commonly used for SSRF against cloud metadata services.\n     */\n    private void checkResolvedAddress(String host) {\n        try {\n            InetAddress addr = InetAddress.getByName(host);\n            if (addr.isLinkLocalAddress()) {\n                throw new DocumentAccessDeniedException(\n                        \"Access denied: link-local address range is blocked (host resolves to \"\n                                + addr.getHostAddress()\n                                + \")\");\n            }\n            if (addr.isLoopbackAddress()) {\n                throw new DocumentAccessDeniedException(\n                        \"Access denied: loopback address is blocked (host resolves to \"\n                                + addr.getHostAddress()\n                                + \")\");\n            }\n        } catch (DocumentAccessDeniedException e) {\n            throw e;\n        } catch (Exception e) {\n            // DNS resolution failure — allow the request to proceed and fail naturally\n            log.debug(\n                    \"Could not resolve host '{}' for access policy check: {}\",\n                    host,\n                    e.getMessage());\n        }\n    }\n\n    private void checkPathTraversal(String normalizedPath) {\n        if (normalizedPath.contains(\"/../\")\n                || normalizedPath.endsWith(\"/..\")","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/ai/src/main/java/org/conductoross/conductor/ai/document/DocumentAccessPolicy.java#L346-L382","documentation":"Thrown by DocumentAccessPolicy.checkResolvedAddress when the resolved InetAddress.isLoopbackAddress() is true (127.0.0.0/8, ::1). Like error 151 it runs after DNS normalization to defeat encoded/obfuscated loopback forms and DNS rebinding. The policy intentionally blocks loopback from document loaders so a loader cannot reach services bound to localhost on the Conductor host. DocumentAccessDeniedException (SecurityException).","triggerScenarios":"An HTTP loader is pointed at localhost/127.0.0.1/::1 or a hostname that resolves to a loopback address — e.g. http://localhost:8080/admin or a rebinding domain flipping to 127.0.0.1.","commonSituations":"Trying to read a local dev server through the document loader; SSRF probing for localhost-only admin endpoints; a service whose public DNS resolves to 127.0.0.1 (misconfiguration).","solutions":["Access the resource via its real external/network address rather than localhost.","If you need local content, load it as a file under an allowed directory instead of over HTTP.","Treat loopback-targeting URLs from untrusted input as SSRF attempts."],"exampleFix":"// before\nloader.download(\"http://localhost:8080/report\")\n// after — use the routable address\nloader.download(\"https://reports.example.com/report\")","handlingStrategy":"validation","validationCode":"// Resolve and reject loopback before the loader call\njava.net.InetAddress a = java.net.InetAddress.getByName(host);\nif (a.isLoopbackAddress()) {\n    throw new SecurityException(\"Refusing loopback host: \" + host + \" -> \" + a.getHostAddress());\n}","typeGuard":null,"tryCatchPattern":"try {\n    loader.download(url);\n} catch (SecurityException e) {\n    // loopback is intentionally blocked — use the routable address\n    throw new SecurityException(\"Blocked loopback resolution for: \" + url, e);\n}","preventionTips":["Access services via their network address, not localhost.","Load local content as a file under an allowed directory rather than over HTTP.","Treat localhost-targeting URLs from untrusted input as SSRF."],"tags":["security","ssrf","access-control","document-loader","dns","loopback"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}