BentoPDF EUVD-2026-101579

Exploitation requires a specific non-default deployment: the worker must run OFF Cloudflare (e.g. workerd, Node, or another runtime inside a cloud VPC that can actually route to internal/RFC1918/loopback/link-local/169.254.169.254 addresses) AND PROXY_SECRET validation must be disabled AND no network-level egress filtering is present. The attacker must additionally control authoritative DNS for a domain with a very low TTL to win the rebinding race between hostnameResolvesToPrivate() and the outbound fetch. Limiting factors: on the default Cloudflare Workers deployment this is NOT exploitable (no route to private/metadata addresses); redirects and IP-literal obfuscation are blocked; precise timing is needed; and network reachability of the worker to the target constrains impact to I:N/A:N (read-only disclosure).

This is a moderate, highly conditional server-side request forgery (SSRF) issue, not a broadly urgent priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N = 6.8 Medium) is internally consistent with the description: network-reachable and requiring no authentication (PR:N applies only when PROXY_SECRET validation is disabled), but with High attack complexity reflecting the CWE-367 TOCTOU race - the attacker must win a timing window between the DNS-over-HTTPS safety check in hostnameResolvesToPrivate() and the later outbound fetch(). No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, the vendor's own fix commit and docs state that the DEFAULT Cloudflare Workers deployment is NOT exploitable (Cloudflare's edge has no route to RFC1918/loopback/link-local/169.254.169.254), so real-world risk collapses to the subset of self-hosters running the worker off Cloudflare (workerd/Node inside a VPC) AND without PROXY_SECRET AND without network egress filtering. The scope change (S:C) and C:H are justified because a successful rebind lets the proxy read internal/cloud-metadata resources and return bodies to the attacker. Net: a real but narrowly-conditioned issue dominated by non-default deployment requirements and high exploitation complexity, not a high-CVSS-but-fictional risk nor a drop-everything emergency.

An organization self-hosts the BentoPDF CORS proxy worker off Cloudflare (e.g. workerd or Node inside a cloud VPC) with PROXY_SECRET unset. An attacker who controls authoritative DNS for their own domain (very low TTL) forges an allowed Origin header and submits a certificate/OCSP/CRL/TSA URL pointing at that domain; the domain answers with a public IP during the safety check, then rebinds to a private or 169.254.169.254 metadata address for the actual fetch, returning internal response bodies to the attacker. No public exploit code was identified, and success requires precise timing since IP-literal obfuscation and redirects are blocked.