SSRF was not in the 2019 OWASP API Security Top 10. It was added in 2023 — a direct response to the proliferation of cloud-hosted APIs and the pattern of cloud metadata endpoint exploitation. The Capital One breach (2019), and similar incidents at other companies, demonstrated that SSRF in a cloud environment is categorically more dangerous than in on-premises deployments.
SSRF often combines with other failures. A misconfigured IAM role (Security Misconfiguration — API8) makes SSRF credentials more powerful. An internal service with no auth (BFLA — API5 in the internal network) makes internal pivot more dangerous. SSRF is often the entry point; other weaknesses determine how far the attacker gets.