CVE-2026-108741 in Shepherd
Summary
by MITRE • 10/11/2026
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Shepherd versions through 0.3.1 represents a classic server-side request forgery scenario rooted in a race condition or logic flaw within the citation-checker module's security controls. The core technical flaw lies in how the application validates external URLs before fetching their content for evidence generation. Specifically, the public_url guard performs an initial DNS resolution to verify that the target address resolves to a non-private IP range, intending to prevent access to internal network resources. However, this validation occurs at a different point in time than the actual HTTP connection establishment. When the application proceeds to fetch the URL, it re-resolves the hostname immediately prior to connecting. This temporal gap allows an attacker who controls the DNS records for the target domain to perform DNS rebinding attacks. By rapidly changing the IP address associated with the hostname between the validation step and the execution of the request, the initial check passes because the domain resolves to a public IP at that moment, but the subsequent fetch operation connects to a private or internal IP address defined in the updated DNS record.
This mechanism effectively bypasses the intended security boundary designed to isolate external content processing from the internal network infrastructure. The operational impact is significant as it allows an attacker who can influence the input documents processed by Shepherd to send arbitrary GET requests to internal HTTP and HTTPS services that are not exposed to the public internet. These services might include administrative interfaces, internal APIs, or other sensitive backend systems. Because the vulnerability involves capturing responses in evidence files, the attacker gains a reliable data exfiltration channel. They can retrieve sensitive information such as configuration details, user credentials, session tokens, or proprietary business logic from these internal services by embedding crafted reference URLs in documents that are subsequently processed by the vulnerable application version.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically illustrating how improper validation of dynamic inputs can lead to unauthorized access to internal resources. It also maps closely to MITRE ATT&CK technique T1557.002 Adversary-in-the-Middle, as the attacker leverages DNS manipulation to intercept and redirect traffic intended for external services toward internal targets. Furthermore, it relates to CWE-643 Improper Mitigation of XEE or SSRF via DNS Rebinding, highlighting the failure to enforce consistent validation across all stages of request processing. The attack vector requires the ability to control DNS records for a domain used in a document processed by Shepherd, which may be achievable through compromised domains, malicious third-party content providers, or social engineering tactics that lead users to submit documents containing such crafted URLs.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade Shepherd to version 0.3.2 or later where this logic flaw has been corrected. If upgrading is not immediately feasible, organizations should implement network-level controls such as egress filtering on the server hosting Shepherd to block outbound connections to private IP ranges regardless of DNS resolution outcomes. Additionally, deploying a web application firewall with SSRF detection capabilities can help identify and block requests that attempt to access internal resources after passing initial validation checks. It is also critical to ensure that any external services accessed by Shepherd are isolated in a DMZ or use distinct network segments that do not contain sensitive backend systems. Regular security audits of citation processing modules should include testing for DNS rebinding vulnerabilities, ensuring that input validation and request execution are tightly coupled or that the application uses IP-based allowlists rather than relying solely on hostname resolution at multiple stages.