CVE-2026-82234: SiYuan SSRF Vulnerability via DNS Rebinding

CVE-2026-82234 Overview

CVE-2026-82234 is a Server-Side Request Forgery (SSRF) vulnerability in SiYuan versions before v3.8.1. The flaw affects the http_request and web_fetch agent tools, which perform DNS resolution only at guard time and fail to validate the connect-time resolution. Attackers exploit this Time-of-Check to Time-of-Use (TOCTOU) gap using DNS rebinding to bypass SSRF defenses. The vulnerability maps to CWE-918: Server-Side Request Forgery.

Critical Impact
Successful exploitation allows attackers to access cloud instance metadata endpoints and internal services, potentially exposing credentials and confidential internal resources.

Affected Products

SiYuan note-taking application versions prior to v3.8.1
http_request agent tool in vulnerable SiYuan builds
web_fetch agent tool in vulnerable SiYuan builds

Discovery Timeline

2026-08-28 - CVE-2026-82234 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82234

Vulnerability Analysis

The vulnerability exists in the SSRF protection logic of the http_request and web_fetch agent tools. The tools resolve a target hostname during the validation phase and confirm the resolved IP address does not point to a private or metadata range. However, the tools do not pin this resolved address for the subsequent HTTP connection. The underlying HTTP client performs an independent DNS lookup when establishing the connection. This creates a TOCTOU window that attackers can exploit through DNS rebinding.

Root Cause

The root cause is inconsistent DNS resolution between the guard check and the connection. The SSRF guard validates one IP address returned by the resolver, while the HTTP client uses a second, unvalidated resolution when opening the socket. Because the guard result is never enforced during the connection, an attacker-controlled DNS server can return different answers for the two lookups.

Attack Vector

An attacker configures an authoritative DNS server for a domain under their control. The server returns a public IP address in response to the first query issued by the SSRF guard, passing validation. On the second query issued by the HTTP client milliseconds later, the server returns a private RFC 1918 address or a cloud metadata endpoint such as 169.254.169.254. The agent tool then establishes a connection to the internal target and returns the response to the attacker. This enables retrieval of AWS IMDS credentials, GCP metadata tokens, and access to internal services not exposed to the internet. See the GitHub Security Advisory GHSA-x8gv-g2g3-65fj and the VulnCheck SSRF Advisory for Siyuan for additional technical detail.

Detection Methods for CVE-2026-82234

Indicators of Compromise

Outbound DNS queries from SiYuan hosts to attacker-controlled domains with very low TTL values, typically under 5 seconds.
Connections originating from the SiYuan process to internal RFC 1918 ranges or the cloud metadata address 169.254.169.254.
Repeated http_request or web_fetch agent tool invocations targeting the same external hostname within short time windows.

Detection Strategies

Monitor process-level network telemetry for the SiYuan binary connecting to private address space or link-local metadata endpoints.
Correlate DNS response TTL anomalies with subsequent internal HTTP connections from the same host.
Alert on egress traffic patterns where a hostname resolves to divergent addresses within a single session.

Monitoring Recommendations

Log all queries to cloud metadata services and treat any request from application workloads as suspicious.
Enable DNS query logging on hosts running SiYuan and retain records for correlation with application logs.
Track version inventory of SiYuan installations and flag any host running a release earlier than v3.8.1.

How to Mitigate CVE-2026-82234

Immediate Actions Required

Upgrade SiYuan to version v3.8.1 or later on every host that exposes the agent tools.
Enforce IMDSv2 with session tokens on AWS workloads to blunt metadata credential theft.
Restrict outbound network access from SiYuan hosts to a documented allowlist of destinations.

Patch Information

The SiYuan maintainers addressed the flaw in release v3.8.1. The fix pins the DNS resolution used by the SSRF guard to the resolution used by the HTTP connection, closing the TOCTOU window. Review the GitHub Security Advisory GHSA-x8gv-g2g3-65fj for release notes and upgrade guidance.

Workarounds

Block egress traffic from SiYuan hosts to 169.254.169.254 and other cloud metadata endpoints at the host firewall or VPC layer.
Deploy an egress proxy that resolves hostnames once and enforces allowlist policy on the final destination address.
Disable the http_request and web_fetch agent tools until upgrade is possible.

bash

# Configuration example
# Block AWS/GCP/Azure metadata endpoint at the host level
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 169.254.170.2 -j REJECT

# Block RFC 1918 ranges from the SiYuan service account (adjust UID)
iptables -A OUTPUT -m owner --uid-owner siyuan -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siyuan -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner siyuan -d 192.168.0.0/16 -j REJECT