SSRF → cloud metadata → IAM credential theft

When it applies

You have SSRF and the app runs on a cloud VM/container with an attached role. The metadata endpoint hands out temporary credentials to anything that can reach it from the instance.

Why it works

IMDS lives at a link-local IP (169.254.169.254) and trusts network position, not identity. SSRF gives you that position, so the app fetches the instance's role credentials for you — then you use them against the cloud API with the app's permissions.