CVE-2026-108741: Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker

Q: Who is exposed to this issue?

Deployments using the citation-checker extra are exposed when they check a document containing an attacker-controlled reference URL. The attacker must control DNS for that hostname and induce a DNS rebinding between validation and the outbound connection.

Q: Are default Shepherd installations affected?

The issue is described in the citation-checker extra. The provided data does not establish that installations not using this extra are affected.

Q: What can an attacker access if exploitation succeeds?

The attacker can cause GET requests to internal HTTP(S) services after rebinding the controlled hostname to an internal address. Responses from those services may be captured in evidence files.

Q: How can I determine whether I may already be affected?

Review citation-checker jobs for checked documents containing references to attacker-controlled domains, and inspect generated evidence files for responses from internal HTTP(S) services. The provided data identifies Shepherd versions through 0.3.1 as affected.

Published Oct 11, 2026

Updated

Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.

Affected Software

1 affected component

pypi/shepherd-ai<=0.3.1

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the citation-checker extra are exposed when they check a document containing an attacker-controlled reference URL. The attacker must control DNS for that hostname and induce a DNS rebinding between validation and the outbound connection.

Are default Shepherd installations affected?

The issue is described in the citation-checker extra. The provided data does not establish that installations not using this extra are affected.

What can an attacker access if exploitation succeeds?

The attacker can cause GET requests to internal HTTP(S) services after rebinding the controlled hostname to an internal address. Responses from those services may be captured in evidence files.

How can I determine whether I may already be affected?

Review citation-checker jobs for checked documents containing references to attacker-controlled domains, and inspect generated evidence files for responses from internal HTTP(S) services. The provided data identifies Shepherd versions through 0.3.1 as affected.

CVE-2026-108741: Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

Are default Shepherd installations affected?

What can an attacker access if exploitation succeeds?

How can I determine whether I may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Are default Shepherd installations affected?

What can an attacker access if exploitation succeeds?

How can I determine whether I may already be affected?