CVE-2026-102354 alam00000 CVE debrief

Who should care

BentoPDF users and administrators should assess their exposure and apply the patch. This vulnerability requires attention from developers and security teams responsible for maintaining and securing BentoPDF installations.

Why it matters

This vulnerability allows for Server-Side Request Forgery (SSRF) via DNS Rebinding in the Cloudflare CORS Proxy Worker, affecting BentoPDF versions through 2.8.6. It requires attention from developers and security teams to assess exposure and apply the patch.

• Verify and apply patches to prevent exploitation
• Assess and limit exposure of BentoPDF installations
• Monitor for potential exploitation attempts
• Validate configuration of PROXY_SECRET validation

Technical summary

The BentoPDF vulnerability allows for SSRF via DNS Rebinding in the Cloudflare CORS Proxy Worker. This issue affects versions through 2.8.6 and is fixed in version 2.8.7. The vulnerability involves a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), used by isValidCertificateUrl() and isValidTsaUrl(), which can be bypassed by a direct client controlling authoritative DNS, allowing forging the Origin header, supplying a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, and returning a public address during validation and a private or link-local address during the later fetch.

Defensive priority

Medium priority for BentoPDF users and administrators to assess exposure and apply the patch.

Recommended defensive actions

• Assess exposure by checking if using BentoPDF version 2.8.6 or earlier
• Apply the patch by updating to BentoPDF version 2.8.7
• Review and validate the configuration of PROXY_SECRET validation
• Monitor for potential exploitation attempts
• Verify network reachability limits the target
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and source item from the CVE Program. The issue involves a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), used by isValidCertificateUrl() and isValidTsaUrl(), which can be bypassed by a direct client controlling authoritative DNS. This allows forging the Origin header, supplying a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, and returning a public address during validation and a private or link-local address during the later fetch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.