CVE-2026-82234

Executive Summary

CVE-2026-82234 is a server-side request forgery (SSRF) vulnerability in SiYuan note-taking software versions before v3.8.1. The vulnerability resides in the HTTP request and web fetching agent tools, which perform DNS resolution only at the security guard stage without validating the DNS result at connection time, allowing a DNS rebinding attack to bypass SSRF protections. Successful exploitation enables attackers to access cloud instance metadata endpoints and internal network services, potentially leading to credential theft and lateral movement. The vulnerability affects all SiYuan deployments prior to v3.8.1 and carries a CVSS score of 8.2 (High).

Technical Analysis

SiYuan is a decentralized note-taking application that stores notes locally and supports plugin-based agent tools for fetching web content. Versions before v3.8.1 expose two agent tool functions—http_request and web_fetch—that facilitate server-side HTTP requests to arbitrary user-specified URLs.

The SSRF defense mechanism in these tools performs a DNS resolution of the target hostname at the time the request is checked against an allowlist or blocklist of prohibited IP ranges (e.g., RFC 1918 private addresses, link-local addresses, and cloud metadata IPs such as 169.254.169.254). The guard logic evaluates the IP address returned by this initial DNS resolution to determine whether the request should be permitted. However, the subsequent actual HTTP connection performs a second, separate DNS resolution. The code does not validate that the resolution result at connection time matches the one observed at guard time.

This TOCTOU (time-of-check-to-time-of-use) flaw is exploitable via classic DNS rebinding. An attacker controls a domain whose DNS responses alternate between two IP addresses: the first resolution (used by the guard) returns a public, non-blocked IP address, passing the security check. The second resolution (used at connection time) returns a private IP address or the cloud metadata IP (169.254.169.254) that should have been blocked. Because the guard and the connection tunnel use separate DNS lookups, the attacker transparently bypasses the SSRF filter.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The CVSS vector reflects a network-based attack (AV:N) with low attack complexity (AC:L), no required privileges (PR:N), user interaction required (UI:R) — likely because the target user must trigger the fetch, a scope change (S:C) since the impact extends beyond the vulnerable component, high confidentiality impact (C:H) because metadata endpoints often expose credentials, and low integrity impact (I:L).

No patch evidence has been observed from any tracked source, and the vendor advisory is not yet publicly available. The affected version range is listed as empty in the CVE data, but the NVD description explicitly states the flaw exists in versions before v3.8.1.

Exploitation Scenarios

Attack chain outline:

1. Reconnaissance and target identification: The attacker identifies a SiYuan instance that exposes the agent tools (http_request, web_fetch) to untrusted input. This may be a self-hosted SiYuan deployment accessible via a browser extension, plugin, or API interface where users can supply URLs to be fetched. The attacker needs to first determine if user-supplied URLs are processed server-side (or through the application's privileged context) and whether the instance hosts sensitive services.

2. Triggering the vulnerability class: The attacker registers a domain under their control and configures DNS such that the same hostname resolves to different IP addresses in response to repeated queries — one public IP (e.g., 203.0.113.10) and one private/metadata IP (e.g., 169.254.169.254). The attacker then submits a request via http_request or web_fetch pointing to this malicious domain. The application's guard performs the first DNS lookup, receives the public IP, and passes the SSRF check. At the actual connection, the second DNS lookup returns the metadata IP, and the HTTP connection is established to the cloud instance metadata service.

3. Payload and execution method: No public PoC is available; the attack chain is inferred from the vulnerability class (DNS rebinding SSRF). The attacker would craft a specially timed URL request through the vulnerable agent tools. Because the HTTP client and the guard perform separate DNS resolutions, the rebinding succeeds, and the HTTP request is forwarded to the internal/metadata endpoint. If the metadata service is reachable, the attacker retrieves the IAM role credentials, cloud-init user data, or other internal service responses.

4. Post-exploitation impact: Once the attacker has obtained cloud metadata credentials (e.g., temporary AWS IAM keys), they can escalate access by authenticating those credentials to the cloud provider's API, potentially gaining access to additional cloud resources, storage buckets, databases, or the ability to launch new instances. The attacker may also target internal HTTP services on private IP ranges for information disclosure or lateral movement within the network.

Impact Assessment

The CVSS v3.1 score of 8.2 (High) reflects several critical factors:

• Confidentiality impact (High): The primary impact is unauthorized disclosure of sensitive information. Cloud instance metadata endpoints commonly expose IAM role credentials, API tokens, and configuration data. Internal services may expose application data or admin interfaces.
• Scope change (Yes): The vulnerable component (the HTTP fetch tools) is compromised, but the impact extends to systems beyond the application itself — namely the cloud infrastructure and internal network services.
• Integrity impact (Low): An attacker may be able to interact with internal write-enabled endpoints, potentially modifying data or triggering actions, though this is secondary to the confidentiality impact.
• Exploitability factors: The attack requires no privileges and leverages the network attack vector, with only user interaction required (likely the user clicking a link or the plugin fetching a malicious URL).
• Availability impact (None): The disclosed data does not include direct denial-of-service effects.

Business impact: Organizations deploying SiYuan in cloud environments are at highest risk. Compromise of IAM credentials can cascade into a full cloud account takeover. Internal service exposure could lead to the disclosure of proprietary data, database access, and potential lateral movement to other systems. The fact that the vulnerability remains unpatched (patch confidence 0/4) increases the operational risk window significantly.

Detection Guidance

Sigma Rule

title: Potential SSRF via DNS Rebinding in SiYuan Agent Tools
id: 3f7a9e2c-4b01-4a11-8c5d-2a9e91f6b3d2
status: experimental
description: Detects DNS rebinding attempts targeting SiYuan http_request or web_fetch agent tools by observing anomalous DNS resolution patterns paired with HTTP requests to known metadata IPs.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82234
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: dns
    product: dns
detection:
    selection_rebinding:
        dns.query.type: "A"
        dns.query.name|endswith: ".com"  # adjust TLD to match attacker-controlled domains
    selection_metadata:
        dns.resolved_ip:
            - "169.254.169.254"  # AWS/Azure/GCP metadata IP
            - "169.254.170.2"    # AWS ECS metadata
            - "10.0.0.0/8"       # RFC 1918 private ranges
            - "172.16.0.0/12"
            - "192.168.0.0/16"
    condition: selection_rebinding and selection_metadata
falsepositives:
    - Legitimate applications resolving private hostnames for internal operations
level: medium
tags:
    - attack.t1190
    - cve.2026.82234

YARA Rule

rule CVE_2026_82234_SiYuan_SSRF_Agent_Tools
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-01"
        description = "Detect SiYuan source code or plugin scripts referencing vulnerable agent tool configurations vulnerable to DNS rebinding SSRF."
        cve = "CVE-2026-82234"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82234"
        score = 60

    strings:
        $a1 = "http_request" ascii wide nocase
        $a2 = "web_fetch" ascii wide nocase
        $b1 = "169.254.169.254" ascii wide nocase
        $b2 = "metadata" ascii wide nocase
        $c1 = "DNS" ascii wide nocase
        $c2 = "rebinding" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and          // MZ header (PE file) or use any file
        (1 of ($a*)) and
        (1 of ($b*) or 1 of ($c*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82234 - Potential SSRF DNS Rebinding via SiYuan Agent Tools"; flow:established,to_server; content:"http_request"; http_uri; content:"web_fetch"; http_uri; content:"169.254.169.254"; http_uri; sid:2026822340; rev:1; classtype:attempted-admin; reference:cve,2026-82234; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

Elastic Detection

sequence by host.name, process.entity_id with maxspan=5s
  [ network where event.action == "lookup_requested" and dns.question.name : "*" and dns.process.name : "siyuan*" ]
  [ network where event.action == "connection_attempted" and destination.ip == "169.254.169.254" and process.name : "siyuan*" ]

Splunk SPL Query

index=* sourcetype=dns
| search query_name=* AND (answer="169.254.169.254" OR answer="10.*" OR answer="172.16.*" OR answer="192.168.*")
| lookup siyuan_process_map dest as query_name
| where process_name="siyuan*"
| table _time src_ip dest_ip query_name answer process_name
| sort -_time

Wazuh OSSEC Rule

<group name="siyuan_ssrf,">
  <rule id="100234" level="10">
    <decoded_as>json</decoded_as>
    <field name="vulnerability.cve">CVE-2026-82234</field>
    <description>SiYuan SSRF vulnerability detected - HTTP request to metadata IP after DNS rebinding</description>
    <group>ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not released an advisory as of this report.

Immediate mitigations (to apply while awaiting the official patch):

1. Upgrade SiYuan to version 3.8.1 or later as soon as the vendor releases the fix. If unavailable, restrict access to SiYuan to trusted users only.
2. Disable or remove the http_request and web_fetch agent tools if not essential to workflows.
3. Implement an outbound network egress firewall that blocks connections to RFC 1918 addresses, link-local addresses, and cloud metadata IPs (169.254.169.254, 169.254.170.2) from the SiYuan process.
4. Apply network segmentation: run SiYuan in a segment isolated from production systems and cloud metadata services.
5. If SiYuan is deployed in a container, configure Docker/Kubernetes network policies to prevent access to the metadata service.

Patch/upgrade steps:

• Monitor the official SiYuan repository (github.com/siyuan-note/siyuan) for the 3.8.1 release notes.
• Once released, upgrade via the application's updater or by replacing the installed binaries.
• Validate the upgrade in a staging environment before production rollout.

Long-term hardening:

• Implement mandatory egress filtering at the host and network level.
• Standardize DNS pinning or use a single DNS resolution object for both validation and connection in any SSRF-prone code.
• Regularly review agent tool plugin code for SSRF patterns.
• Deploy a WAF or reverse proxy to inspect and restrict URL schemes and target IPs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82234
2. SiYuan Official Repository: https://github.com/siyuan-note/siyuan (watch for v3.8.1 release advisory)
3. OWASP Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
4. CWE-918: https://cwe.mitre.org/data/definitions/918.html
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns have been reported for this CVE at the time of writing. CISA KEV does not list this CVE, and no exploit code or Nuclei template is publicly available. EPSS scoring has not yet been assigned by FIRST.org.