A feature that borrows the server's own access
Server-side request forgery tricks a server into making a request to a destination on the attacker's behalf — often an internal resource the attacker has no direct access to, but the server, sitting inside the network, does. A feature that legitimately fetches a URL supplied by a caller, such as generating a preview of a linked page, can be abused to make the server issue a request to internal systems the caller was never authorized to reach on their own.
This is a specific, extremely common instance of the confused deputy problem, playing out in ordinary web application code: the server holds more network reach than the caller does, and a request that looks like an ordinary fetch is actually borrowing the server's own broader access to reach somewhere the caller couldn't have gone directly on their own credentials.
Treating the fetch as untrusted input, not an internal operation
Defending against this means treating a server-side fetch of a caller-supplied destination as exactly as untrusted as any other caller input — validating and restricting what destinations the server will actually fetch on a caller's behalf — rather than treating the fetch as an internal server operation exempt from the scrutiny applied to everything else the caller controls. The vulnerability exists precisely because that fetch gets treated as more trustworthy than the caller-supplied input driving it actually deserves.