Anyquery's "server" mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules (e.g., "json_reader", "log_reader"). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or Cloud Metadata IPs (e.g., "http://169.254.169.254/latest/meta-data/"). This allows attackers to perform Server-Side Request Forgery (SSRF), bypassing external firewalls to scan internal ports and exfiltrate cloud credentials.