TI-2026-70720 CVE-2026-108741 · GHSA-53wh-3r96-488v
DNS rebinding bypasses SSRF guard in Shepherd citation checker
Priority LOW 11
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at conne…