CVE-2026-102354

Deferred Deferred - Pending Action

DNS-over-HTTPS Validation Bypass in BentoPDF

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102354

EUVD

EUVD-2026-101579

Affected Vendors & Products

Vendor	Product	Version / Range
alam00000	bentopdf	< 2.8.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-102354 is a Server-Side Request Forgery (SSRF) vulnerability in BentoPDF's Cloudflare CORS Proxy Worker. It occurs due to a Time-of-Check Time-of-Use (TOCTOU) race condition caused by DNS rebinding. The worker validates a user-supplied URL to ensure it does not resolve to a private or reserved IP address, but this validation happens separately from the actual fetch request. An attacker controlling DNS can serve a public IP during validation and a private IP during the real request, bypassing protections.

Detection Guidance

Detecting this SSRF vulnerability requires monitoring DNS resolution and outbound requests. Check for DNS rebinding attempts by analyzing DNS logs for rapid IP changes. Use tools like tcpdump or Wireshark to inspect outbound traffic for requests to private/internal IPs. Verify if PROXY_SECRET is enforced in your CORS proxy configuration. Examine logs for mismatches between validation and fetch IPs.

Impact Analysis

An attacker could exploit this to access internal services or sensitive data by tricking the proxy into fetching URLs pointing to private networks. Exploitation requires precise timing, attacker-controlled DNS with short TTL, and network reachability. While response bodies are limited, confidentiality impact is high as internal services may be exposed.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may violate Article 32 (security of processing) if personal data is accessed. For HIPAA, it could compromise protected health information (PHI) if internal healthcare systems are targeted. Organizations must address this to maintain compliance.

Mitigation Strategies

Upgrade to BentoPDF v2.8.7 or later. Enable and enforce PROXY_SECRET HMAC validation in your CORS proxy. Implement network-level egress filtering to block outbound connections to private, loopback, link-local, and metadata addresses. Revalidate hostnames close to fetch time and avoid relying on Origin header allow-lists as a security control.

Hi! I’m here to help you understand CVE-2026-102354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70