Defending the fetcher
Input validation alone never fixes SSRF — an attacker controls the URL, and redirects and DNS tricks defeat blocklists. The real defences are layered:
Tip: Allow-list the exact hosts/schemes the feature is meant to reach and reject everything else; block requests to private and link-local ranges (and re-check after every redirect); and — crucially — stop internal services from trusting a request just because it came from inside the network. The admin API here fell precisely because it trusted a header any internal caller could send.