CVE-2026-107460

Executive Summary

CVE-2026-107460 is a server-side request forgery (SSRF) protection bypass in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating. The converter validates the hostname's resolved IP address and then opens a separate connection that resolves the hostname again, enabling a DNS rebinding attack to reach restricted internal addresses after validation. Applications that accept attacker-controlled image URLs for spreadsheet writing are affected; the impact is internal-network reachability and information exposure from the server's position in the network.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery), specifically a time-of-check-to-time-of-use (TOCTOU) weakness in the DNS resolution path of the remote image fetching feature.

Apache Fesod's UrlImageConverter, when used to write images into a spreadsheet from an application-supplied URL, performs SSRF validation by resolving the hostname to one or more IP addresses and checking those addresses against a restricted-address policy. According to the NVD description, the converter "checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again."

This is the canonical DNS rebinding defect pattern:

1. Validation phase — the guard resolves the attacker's hostname and receives a benign, publicly routable IP that passes the restricted-address check.
2. Connection phase — the actual outbound HTTP connection is established later and performs its own, independent DNS resolution of the same hostname.
3. Rebinding window — between the two resolutions, the attacker's authoritative DNS server changes the answer to a restricted address (for example, loopback or an internal RFC1918 address). The second resolution returns the restricted IP, and the connection proceeds to it without re-validation.

Because the two operations are not bound to a single, pinned resolution result, the security check is applied to a value that the attacker controls and can change. The underlying weakness is insufficient synchronization between the address that is validated and the address that is contacted — the classic "check-then-connect" anti-pattern.

fesod-sheet is an Apache POI-based spreadsheet library (Apache Fesod, Incubating) used to read and write spreadsheet documents. The attack surface is any application that accepts an image URL from an untrusted source and passes it to the spreadsheet-writing path where the image converter fetches remote content by URL. The vulnerability is not a memory-safety issue; it is a network-boundary and authorization issue realized through DNS behavior.

A closely related prior issue, CVE-2026-49328, covers SSRF in releases before 2.0.2-incubating. CVE-2026-107460 is specifically the DNS rebinding bypass of the protection introduced in 2.0.2-incubating, meaning the mitigation added in that release was incomplete.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE, and no vendor-issued patch is evidenced in any tracked source. The remediation path documented by the project is version 2.1.0-incubating, which addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SSRF via DNS rebinding) and the mechanism described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies an application that uses Apache Fesod fesod-sheet to generate spreadsheets and that accepts an externally supplied image URL (for example, a user-supplied image source field that is written into the output spreadsheet). The attacker confirms that UrlImageConverter performs a remote fetch of that URL and that the application will perform the fetch server-side.

2. Triggering the specific flaw class. The attacker supplies a URL whose hostname is controlled by an attacker-operated authoritative DNS server. The UrlImageConverter guard resolves the hostname and receives an attacker-chosen first answer — a benign, publicly routable IP that passes the restricted-address validation. The converter then begins to open the outbound connection.

3. Payload / execution method (vulnerability class). The attacker's DNS server lowers the record's time-to-live before the connection phase and returns a second answer for the same hostname. When the connection code performs its own resolution (the "separate connection that can resolve the hostname again," per the NVD description), it receives a restricted address — such as loopback or an internal address — that was never subjected to validation. This is the DNS rebinding step: the hostname is valid throughout, but its answer changes between the check and the use. The server then connects to the restricted address on the attacker's behalf.

4. Post-exploitation impact. The server-side request reaches a network destination the attacker could not reach directly. Depending on the target service at the rebound address, this can expose internal-only HTTP services, cloud instance metadata endpoints, or internal administrative interfaces to retrieval by the server, with responses potentially reflected back into the generated spreadsheet or into error output. The scope is bounded by what the server can reach and by what the attacker can observe from the response, but the trust boundary of the network perimeter is crossed.

No specific function names, file paths, URL endpoints, or parameters beyond those named in the NVD Description (UrlImageConverter, fesod-sheet, 2.0.2-incubating, 2.1.0-incubating) are asserted here. The exact payload encoding and the precise number of DNS answers required depend on implementation detail not available in the provided data.

Impact Assessment

CWE-918 / SSRF via DNS rebinding yields a network-perimeter and confidentiality impact rather than code execution. The validating host derives its authority from its own network position: a rebound connection can reach internal addresses that are unreachable from the public internet.

• Confidentiality: High. The attacker can direct the server to fetch restricted resources and, where the fetched content is written into the generated spreadsheet or surfaced in responses/errors, read data the attacker should not see. Unauthorized access to internal services and metadata endpoints is the principal concern.
• Integrity: None / Low. The described mechanism is a fetch-and-reflect operation; no write primitive is described.
• Availability: None. No denial-of-service mechanism is described.
• Attack Vector: Network. The URL is supplied remotely.
• Attack Complexity: High. Successful exploitation requires the attacker to control DNS answers for the URL hostname and to win the rebinding window between validation and connection.
• Privileges Required: None / User Interaction: None. The attacker supplies the URL as data; no authenticated role or victim action beyond normal use of the application's URL-accepting feature is described.
• Scope: Changed. The vulnerable component's security authority is used to reach resources in a different security scope (internal network) than the one the attacker should be confined to.

Blast radius: any deployment of fesod-sheet 2.0.2-incubating (and relevant earlier SSRF-affected releases) where the application passes untrusted URLs into the image-fetching spreadsheet-writing path. Systems are most exposed when the validating host has broad egress — for example, hosts with access to cloud instance metadata services or to internal administration networks. No CVSS score is published in the provided data (N/A), no EPSS score has been assigned, and there is no CISA KEV listing.

Detection Guidance

Sigma Rule

title: Potential SSRF via Apache Fesod UrlImageConverter DNS Rebinding
id: 8f3a1c2e-5b7d-4e91-9a04-7c6d2f1b0e33
status: experimental
description: Detects outbound HTTP connections from a Java process to loopback or RFC1918 addresses, consistent with SSRF against Apache Fesod fesod-sheet image fetching.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107460
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith: '\java.exe'
  selection_internal:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
    Initiated: 'true'
  condition: selection_proc and selection_internal
falsepositives:
  - Legitimate Java services connecting to internal APIs
level: medium

YARA Rule

rule CVE_2026_107460_Fesod_UrlImageConverter
{
    meta:
        description = "Detection heuristic for Apache Fesod fesod-sheet UrlImageConverter SSRF/DNS rebinding artifact"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107460"
        cve = "CVE-2026-107460"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $c1 = "UrlImageConverter" ascii wide
        $c2 = "fesod-sheet" ascii wide
        $c3 = "2.0.2-incubating" ascii wide
        $c4 = "fesod" ascii nocase wide
    condition:
        ($c1 and $c2) or ($c1 and $c3) or ($c2 and $c4)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET [80,443,8080,8443] (msg:"CVE-2026-107460 Possible Apache Fesod UrlImageConverter SSRF via DNS Rebinding"; flow:established,to_server; content:"GET"; http_method; reference:cve,2026-107460; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107460; classtype:attempted-recon; sid:2026107460; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_107460;)

Elastic Detection

network where process.name : "java*" and destination.ip : (
  "127.0.0.0/8",
  "10.0.0.0/8",
  "172.16.0.0/12",
  "192.168.0.0/16",
  "169.254.0.0/16"
)

Splunk SPL Query

index=proxy OR index=firewall OR index=sysmon
| search (Image="*\\java.exe" OR process_name=java)
| where match(dest_ip, "^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, process_name
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="apache_fesod,cve-2026-107460,">
  <rule id="107460" level="8">
    <decoded_as>json</decoded_as>
    <field name="Image">\.?\\java\.exe$</field>
    <field name="DestinationIp">^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)</field>
    <description>CVE-2026-107460: Java process connected to internal address, possible Apache Fesod UrlImageConverter SSRF via DNS rebinding.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_918,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix and no official workaround are recorded in the provided data.

1. Immediate mitigations

   • Follow the project's documented remediation: upgrade to Apache Fesod (Incubating) 2.1.0-incubating, which disables remote URL image fetching by default and addresses the reported default-fetch scenario.
   • If upgrade is not immediately possible, disable the remote URL image fetching feature in application code so that UrlImageConverter does not perform server-side fetches of externally supplied URLs.
   • Where the feature must remain enabled, apply the project's recommended control from 2.1.0-incubating: require an explicit exact-host allowlist and permit only hostnames whose DNS and HTTP services are trusted.
   • Do not accept attacker-controlled URLs directly into the spreadsheet-writing image path; treat image sources as untrusted input and validate against a fixed, operator-controlled set of hosts rather than a policy evaluated against attacker-influenced DNS.
   • Reduce the validating host's egress: network-policy deny of loopback, link-local, and RFC1918 ranges from the application host limits the reachable post-rebind targets.

2. Patch / upgrade steps

   • Identify applications that embed fesod-sheet and pass external image URLs to the spreadsheet-writing path.
   • Upgrade fesod-sheet to 2.1.0-incubating (the release that disables default remote fetching and introduces the exact-host allowlist requirement).
   • Confirm the default remote-fetch behavior is off after upgrade, and that enabling it requires a configuration-level allowlist.
   • Regression-test spreadsheet generation with remotely referenced images to verify the feature behaves as configured.

3. Long-term hardening

   • Eliminate the check-then-connect (TOCTOU) pattern in URL fetch logic: resolve once and connect to the validated address, or re-validate every resolution result immediately before use, so the connected address is the validated address.
   • Enforce an egress denial policy for loopback, link-local, and internal address ranges from all application hosts that perform outbound fetches.
   • Prefer fetching externally referenced images through a dedicated proxy that applies allowlisting and internal-range blocking.
   • Treat DNS as untrusted input in all SSRF defenses; do not rely on a single pre-connection resolution as a security boundary.
   • Track CVE-2026-49328 as well, since it is the related pre-2.0.2-incubating SSRF issue; this CVE is specifically the bypass of the 2.0.2-incubating protection.

References

• NVD — CVE-2026-107460: https://nvd.nist.gov/vuln/detail/CVE-2026-107460
• NVD — CVE-2026-49328 (related prior SSRF in releases before 2.0.2-incubating): https://nvd.nist.gov/vuln/detail/CVE-2026-49328
• Apache Fesod (Incubating) project site and release notes for 2.1.0-incubating and 2.0.2-incubating
• MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-107460 is not listed as of this report; no exploit-in-the-wild evidence or named threat-actor campaign is known for this CVE.