CVE-2026-108741
Description
A flaw was found in shepherd-ai. The citation-checker component verifies destination addresses to prevent internal network access, but resolves the target hostname a second time when initiating the connection. A remote attacker who controls Domain Name System (DNS) records for a link in a processed document can exploit this behavior through DNS rebinding to bypass Server-Side Request Forgery (SSRF) protections. This vulnerability allows an attacker to send unauthorized requests to internal network services and potentially disclose sensitive information.
Statement
This vulnerability is rated as Low severity due to the high attack complexity and specific preconditions required, as an attacker must manipulate DNS records and entice an application user to parse an untrusted document. The issue is restricted to the optional citation-checker extension, limiting unauthorized network interaction strictly to read-only retrieval of responses from internal HTTP services without compromising host integrity. Furthermore, shepherd-ai is not included or supported in Red Hat Enterprise Linux or other Red Hat core products.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Access Control
Technical Impact: Bypass Protection Mechanism
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
