projectdiscovery/nuclei · error

target denied by network policy

Error message

target denied by network policy

What it means

Sentinel error representing 'the target was excluded by the configured network policy'. The goexec adapter validates every network-facing host against protocolstate.IsHostAllowed before executing. Note: in the current tree this exact sentinel has no throw site; the top-level target check returns protocolstate.ErrHostDenied.Msgf(req.Target) instead (adapter_goexec.go:38-40), while this exported value serves as the stable classification of the denial family for embedders and tests.

Source

Thrown at pkg/js/libs/goexec/errors.go:15

package goexec

import "errors"

var (
	ErrMissingAuth             = errors.New("goexec auth is required")
	ErrMissingUsername         = errors.New("goexec username is required for this auth mode")
	ErrMultipleCredentialModes = errors.New("goexec auth selects multiple primary credential modes")
	ErrMissingTarget           = errors.New("goexec target is required")
	ErrMissingCommand          = errors.New("goexec command is required")
	ErrMissingExecutable       = errors.New("goexec executable is required")
	ErrUnsupportedModule       = errors.New("unsupported goexec module")
	ErrUnsupportedMethod       = errors.New("unsupported goexec method")
	ErrUnsupportedOutputMethod = errors.New("unsupported goexec output method")
	ErrNetworkPolicyDenied     = errors.New("target denied by network policy")
	ErrInvalidMethodArguments  = errors.New("invalid goexec method arguments")
	ErrDomainControllerDenied  = errors.New("domain controller denied by network policy")
	ErrProxyDenied             = errors.New("proxy denied by network policy")
	ErrEndpointDenied          = errors.New("endpoint denied by network policy")
)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Add the target IP/CIDR to the network policy allow list (or remove it from the deny list) and rerun
2. Verify the resolved IP with protocolstate.IsHostAllowed before submitting the request
3. In code, match denials with errors.Is against both protocolstate.ErrHostDenied and this sentinel, since the adapter returns the former today

host := targetHost(req.Target)
if !protocolstate.IsHostAllowed(executionID, host) {
    return fmt.Errorf("target %s blocked by network policy", host)
}

func isNetworkPolicyDenied(err error) bool {
    return errors.Is(err, goexec.ErrNetworkPolicyDenied) || strings.Contains(err.Error(), "denied by network policy")
}

if _, err := goexec.Run(req); err != nil && isNetworkPolicyDenied(err) { /* add CIDR to policy or skip target */ }

When it happens

Trigger: Running a goexec request against a host whose IP is outside the allowed CIDR ranges (or matches a denied range) while a network policy is configured; any SDK embedding that calls protocolstate with an active NetworkPolicy and a disallowed target.

Common situations: Hardened deployments that restrict nuclei to specific CIDRs; CI environments that deny RFC1918 ranges; target hostname resolves to an IP that falls into a denied range.

Related errors

• domain controller denied by network policy
• proxy denied by network policy
• protoset path denied: %w
• headless mode (-headless) is required if -ho, -sb, -sc or -l
• both follow host redirects and follow redirects specified

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/80ec10f0b1082bf7. Report an issue: GitHub.