THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9hgc-g3w5-67cm (medium) — ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

[GHSA] GHSA-9hgc-g3w5-67cm (medium) — ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

highgithub_advisoriesPublished 2026-08-14

GHSA-9hgc-g3w5-67cm Severity: medium CVE: CVE-2026-53708

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

## Summary

The `/admin/gateways/test` endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between

MITRE ATT&CK techniques

DNS ServerT1583.002
Cloud AccountT1087.004
Cloud AccountT1136.003
CredentialsT1589.001
DNS ServerT1584.002

Indicators of compromise

CVE-2026-53708cve
http://127.0.0.1:8000/admin/gateways/testurl
http://169.254.169.254/latest/meta-data/url
1.2.3.4ipv4
10.0.0.0/8cidr
172.16.0.0/12cidr
192.168.0.0/16cidr
169.254.169.254/32cidr
rbndr.usdomain

Original source: https://github.com/advisories/GHSA-9hgc-g3w5-67cm