{"record":{"id":"80ec10f0b1082bf7","repo":"projectdiscovery/nuclei","slug":"target-denied-by-network-policy","errorCode":null,"errorMessage":"target denied by network policy","messagePattern":"target denied by network policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/goexec/errors.go","lineNumber":15,"sourceCode":"package goexec\n\nimport \"errors\"\n\nvar (\n\tErrMissingAuth             = errors.New(\"goexec auth is required\")\n\tErrMissingUsername         = errors.New(\"goexec username is required for this auth mode\")\n\tErrMultipleCredentialModes = errors.New(\"goexec auth selects multiple primary credential modes\")\n\tErrMissingTarget           = errors.New(\"goexec target is required\")\n\tErrMissingCommand          = errors.New(\"goexec command is required\")\n\tErrMissingExecutable       = errors.New(\"goexec executable is required\")\n\tErrUnsupportedModule       = errors.New(\"unsupported goexec module\")\n\tErrUnsupportedMethod       = errors.New(\"unsupported goexec method\")\n\tErrUnsupportedOutputMethod = errors.New(\"unsupported goexec output method\")\n\tErrNetworkPolicyDenied     = errors.New(\"target denied by network policy\")\n\tErrInvalidMethodArguments  = errors.New(\"invalid goexec method arguments\")\n\tErrDomainControllerDenied  = errors.New(\"domain controller denied by network policy\")\n\tErrProxyDenied             = errors.New(\"proxy denied by network policy\")\n\tErrEndpointDenied          = errors.New(\"endpoint denied by network policy\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":21,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/goexec/errors.go#L1-L21","documentation":"Sentinel error representing 'the target was excluded by the configured network policy'. The goexec adapter validates every network-facing host against protocolstate.IsHostAllowed before executing. Note: in the current tree this exact sentinel has no throw site; the top-level target check returns protocolstate.ErrHostDenied.Msgf(req.Target) instead (adapter_goexec.go:38-40), while this exported value serves as the stable classification of the denial family for embedders and tests.","triggerScenarios":"Running a goexec request against a host whose IP is outside the allowed CIDR ranges (or matches a denied range) while a network policy is configured; any SDK embedding that calls protocolstate with an active NetworkPolicy and a disallowed target.","commonSituations":"Hardened deployments that restrict nuclei to specific CIDRs; CI environments that deny RFC1918 ranges; target hostname resolves to an IP that falls into a denied range.","solutions":["Add the target IP/CIDR to the network policy allow list (or remove it from the deny list) and rerun","Verify the resolved IP with protocolstate.IsHostAllowed before submitting the request","In code, match denials with errors.Is against both protocolstate.ErrHostDenied and this sentinel, since the adapter returns the former today"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"host := targetHost(req.Target)\nif !protocolstate.IsHostAllowed(executionID, host) {\n    return fmt.Errorf(\"target %s blocked by network policy\", host)\n}","typeGuard":"func isNetworkPolicyDenied(err error) bool {\n    return errors.Is(err, goexec.ErrNetworkPolicyDenied) || strings.Contains(err.Error(), \"denied by network policy\")\n}","tryCatchPattern":"if _, err := goexec.Run(req); err != nil && isNetworkPolicyDenied(err) { /* add CIDR to policy or skip target */ }","preventionTips":["Pre-resolve and policy-check every target before batch submission","Keep policy CIDR lists in config, not ad-hoc flags","Match on protocolstate.ErrHostDenied too, since the adapter returns that variant"],"tags":["goexec","network-policy","security","configuration"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}