A link-local address is an IP address that works only on the local host or local network segment and is not meant to be routed across the internet or wider network. In cloud systems, link-local addresses are often used for special services such as instance metadata, DNS helpers, or other platform-controlled endpoints. Because they are reachable from inside the machine or link, they sit in a sensitive trust zone that normal perimeter controls may not cover.
In cyber security, link-local addresses matter because attackers who gain a path into a host may try to reach local-only services to steal tokens, configuration data, or temporary credentials. Common abuse paths include server-side request forgery, misused port forwarding, and overly broad management tunnels that can pivot toward local endpoints. Defenders should treat these addresses as high-value internal assets, restrict who can proxy or forward to them, and harden metadata access so only intended processes and identities can use it.