CVE-2026-82234— SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SiYuan v3.8.1 之前的版本中， 和 代理工具中存在服务器端请求伪造（SSRF）漏洞。这些工具仅在“防护阶段”（guard time）进行 DNS 解析，而未验证“连接阶段”（connect time）的解析结果。攻击者可利用 DNS 重绑定（DNS Rebinding）技术，使防护阶段的解析返回公网 IP，而连接阶段的解析则指向私有 IP 或云实例元数据 IP，从而绕过 SSRF 防护机制，进而访问云实例的元数据服务和内部服务。
Possible ATT&CK Techniques 3 AI
T1011 · Exfiltration Over Other Network Medium T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.8.1 | - |
|
II. Public POCs for CVE-2026-82234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82234
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82234 (2)
-
-
🔗 SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-82233
SiYuan before v3.8.1 Path Traversal via asset.upload -
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-59809
SiYuan before v3.8.0 Secret Exfiltration via http_request UR
Same vendor: siyuan-note
-
CVE-2026-82233
SiYuan before v3.8.1 Path Traversal via asset.upload -
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-59809
SiYuan before v3.8.0 Secret Exfiltration via http_request UR
Same weakness: CWE-918
-
CVE-2026-82246
Budibase Server before 3.41.3 SSRF via Query Import -
CVE-2026-82243
Budibase Server before 3.41.3 SSRF with Credential Leakage -
CVE-2026-82241
Budibase backend-core SSRF via incomplete default blacklist -
CVE-2026-9491
Synology Chat Server 2.4.5前Webhook存在SSRF漏洞 -
CVE-2026-82081
Wallabag 2.0至2.6.14 PDF导出SSRF
V. Comments for CVE-2026-82234
No comments yet