CVE-2026-61840
Received Received - Intake

Quest Bot DNS Rebinding via Image to GIF Command

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through `DNS rebinding`. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to `HTTPS on port 443`, and content is returned only when the response is a `genuine image`. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-61840
EUVD
EUVD-2026-114279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vantern-org questbot < 1.1.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Quest Bot is a Discord bot where a command for converting images to GIFs performs a DNS lookup to validate a hostname's public IP before sending a request. However, it sends the actual request using the hostname again, allowing an attacker to control a domain that returns a public IP during validation but an internal IP during the connection. This bypasses protections against internal addresses via DNS rebinding. The flaw requires no special permissions to exploit and is fixed in version 1.1.9.

Detection Guidance

This vulnerability involves DNS rebinding in the Quest Bot's image to GIF command. To detect it, monitor DNS queries for unusual hostname resolutions or repeated lookups from the bot. Check if the bot makes requests to internal IP addresses after validating public IPs. Inspect network traffic for HTTPS requests to unexpected endpoints on port 443.

Impact Analysis

An attacker could probe internal systems by tricking the bot into making requests to internal addresses. While limited to HTTPS on port 443 and only returning image responses, this could allow blind internal probing and retrieval of some image data from internal endpoints. Cloud metadata services using plain HTTP on other ports are not reachable through this flaw.

Mitigation Strategies

Upgrade Quest Bot to version 1.1.9 or later to patch the vulnerability. If upgrading is not possible, restrict the bot's network access to prevent outbound connections to internal addresses. Disable the image to GIF command if unused. Monitor for unusual DNS or network activity related to the bot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart