Vulnerabilities
SSRF
Also: server-side request forgery
Making a server send requests to places the attacker chooses, often internal services or cloud metadata endpoints.
In more detail
Agents that fetch URLs are natural SSRF targets: a link to an internal address might return credentials. Block requests to private ranges and metadata addresses, and require authentication on internal services.