CVE-2026-82234: Server-Side Request Forgery (SSRF) in siyuan-note siyuan

CVE-2026-82234 is a server-side request forgery vulnerability affecting SiYuan note-taking software prior to version 3.8.1. The vulnerability exists in the http_request and web_fetch agent tools, which perform DNS resolution only during an initial guard phase but do not validate the DNS resolution at the time of connection. Attackers can exploit this by using DNS rebinding techniques to respond with a public IP during the guard resolution and a private or metadata IP during the actual connection, thereby bypassing SSRF defenses and potentially accessing sensitive internal resources such as cloud instance metadata endpoints.

Successful exploitation could allow an unauthenticated attacker to bypass SSRF protections and access internal services or cloud instance metadata that are normally protected from external access. This could lead to information disclosure or further attacks leveraging internal service access. The CVSS 4.0 score of 8.4 indicates a high severity vulnerability with network attack vector, low attack complexity, no privileges required, and partial user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v3.8.1, upgrading to version 3.8.1 or later is likely to address the issue once the vendor releases a fix. Until then, monitor vendor communications for an official patch or workaround.