Server-Side Request Forgery Vulnerability in Shepherd by Shepherd Agents

CVE-2026-108741

What is CVE-2026-108741?

The Shepherd product, specifically versions up to 0.3.1, is vulnerable to a server-side request forgery (SSRF) due to an oversight in its citation-checker module. The vulnerability arises because the 'public_url' guard only validates a resolved address, allowing an attacker to inject a malicious reference URL into documents. By controlling the DNS resolution, the attacker can redirect requests to internal HTTP(S) services, potentially exposing sensitive data. This exploitation can lead to unauthorized access to internal systems and leakage of responses captured in evidence files. Users of the affected version are advised to apply security patches and review their configurations to mitigate this risk.

References