Shepherd 0.3.1 SSRF via DNS Rebinding Analysis (CVE-2026-41488)

CVE-2026-41488 / CVE-2026-108741: Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker Vulnerability Overview Shepherd's extra feature retrieves citation evidence via HTTPS. Before each retrieval, it runs a guard named which parses the URL hostname and checks whether any resolved addresses are globally routable. It then discards the resolved addresses. The fetcher in passes the original hostname URL to via , meaning the HTTP client resolves the hostname a second time when it opens the socket and connects to whatever the second resolution returns. The validated address is never bound to the connection. If an authoritative DNS server returns a public address for the guard but passes a hostname resolving to a private address for the connection, the request can bypass the guard and connect to a private address. The default citation checking path reaches this code via with . Collectors extract arbitrary URLs from attacker-influenced input. Victim checks on documents in attacker-controlled citation strings can drive server-side requests to internal services on port 80 or 443. The response is captured into the run evidence records. This report establishes that private address requests reach loopback services while simulating a rebinding resolver; compared to a real fixed source, private addresses are captured into the run record. It does not establish a direct attacker read-back channel. Impact Scope Project: shepherd-agents/shepherd, Shepherd, shepherd-citation-checker: optional extra Affected Versions: PyPI shepherd-ai 0.3.1, tag v0.3.1 and main, both at commit d34d5ca334871dfcb5a3dc76dd78d45829fa4e56. Earlier ranges were not truncated. Classes: CWE-918 Server-Side Request Forgery, CWE-367 Time-of-check Time-of-use Race Condition, CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action Status: Coordinated disclosure in progress, preparation for VulnCheck underway. No CVE assigned yet. Remediation Fix Code: Fix Description: The fix code ensures that after resolving the hostname, all resolved addresses are checked for global routability. If any are not globally routable, an exception is raised. Attack Flow 1. Prepare Rebinding Hostname: Run an authoritative DNS server that provides a public address for queries to and a private address for the next query, with a TTL of 0 so that no answers are cached. 2. Inject URL into Citation Text: Provide citation text containing without an arXiv identifier. For example, in a bibliography entry within a PDF or a citation object passed to an API. 3. Victim Runs Checker: The victim invokes or , where defaults to true. 4. Guard Resolves and Allows: calls , extracts , and then calls . Inside , resolves the hostname. The DNS server returns a public address, so is true, and the guard allows the URL. 5. Connection Re-resolves and Hits Internal Service: calls . resolves the hostname a second time. The DNS server now returns a private address, so the socket connects to port 80 on the internal service and sends . 6. Response is Captured: The internal service responds. reads the body up to 4,000,000 bytes and writes a record with status, resolved URL, body, or resolved metadata to the run evidence directory. The guard intended to prohibit private and local source URLs fails to block the request. Verification Verification Code: Verification Description: The verification code confirms the existence of the vulnerability and demonstrates how an attacker can leverage DNS rebinding to bypass the guard and access internal services.

Goal Reached Thanks to every supporter — we hit 100%!

Shepherd 0.3.1 SSRF via DNS Rebinding Analysis (CVE-2026-41488)

More from this source