DNS rebinding bypasses SSRF guard in Shepherd citation checker
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra. The public_url guard validates a resolved address, but fetch resolves the hostname again at connect time (CWE-367). A remote attacker who plants a crafted reference URL in a checked document and controls its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing the responses in evidence files.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| shepherd-agents | Shepherd | up to 0.3.1 | — | No fix listed | CNA |
- Shepherd Vendorshepherd-agents Affected up to 0.3.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Shepherd.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Vendor assessments
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108741
- 2026-10-11 Alias added: GHSA-53wh-3r96-488v
- 2026-10-13 CISA SSVC decision points changed
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-07 CVSS score added · Red Hat
References
Other 3
- https://github.com/shepherd-agents/shepherd/blob/d34d5ca334871dfcb5a3dc76dd78045829fa4e56/shepherd/extras/citation-checker/src/shepherd_citation_checker/_engine/network.py#L9-L17
- https://github.com/shepherd-agents/shepherd/blob/d34d5ca334871dfcb5a3dc76dd78045829fa4e56/shepherd/extras/citation-checker/src/shepherd_citation_checker/_engine/fetch.py#L34-L55
- https://github.com/shepherd-agents/shepherd
Sources
- CVE-2026-108741 · CVE Program
- CVE-2026-108741 · NVD
- FIRST EPSS
- GHSA-53wh-3r96-488v · GitHub Advisory Database · CC BY 4.0
- CVE-2026-108741 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences