CVE-2026-42346 — Server-Side Request Forgery

title: CVE-2026-42346 - Postiz SSRF DNS Rebinding to Internal IP
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
  This rule detects DNS queries for internal IP ranges or localhost that are part of a DNS rebinding attack. This is specific to CVE-2026-42346 where the Postiz application's isSafePublicHttpsUrl() function resolves DNS, and a subsequent fetch() call resolves DNS independently, creating a window for DNS rebinding to target internal resources.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42346/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: dns
detection:
  selection:
      dst_domain|contains:
          - 'localhost'
          - '127.0.0.1'
      dst_ip|contains:
          - '192.168.'
          - '10.0.'
          - '172.16.'
          - '172.17.'
          - '172.18.'
          - '172.19.'
          - '172.20.'
          - '172.21.'
          - '172.22.'
          - '172.23.'
          - '172.24.'
          - '172.25.'
          - '172.26.'
          - '172.27.'
          - '172.28.'
          - '172.29.'
          - '172.30.'
          - '172.31.'
      condition: dst_domain AND dst_ip
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse