An internal endpoint is a service address intended to be reachable only from inside a private network. It may be a database admin API, a loopback-only listener, an RFC1918 address, or a cloud metadata service. These systems are usually trusted because they are not exposed to the public internet.
In cyber security, internal endpoints matter because a flaw in a web application can turn the application into a bridge into private infrastructure. If attacker-controlled input influences a server’s outbound requests, the server may fetch data from internal-only addresses and leak secrets, credentials, or configuration. This is a common SSRF-style pattern. Defenders reduce the risk with network segmentation, egress filtering, allowlists, and by blocking access to metadata services from untrusted workloads. The goal is to keep internal services private even if an external user can influence a server’s behavior.