Live › vulnerability › CVE-2026-61840
Quest Bot, an open-source Discord bot, checks a hostname's IP address but then connects by name, so a second DNS lookup can point it at an internal address. Members of a server with the bot can use the image-to-GIF command to probe internal HTTPS endpoints and retrieve image responses from them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Teams that run the Quest Bot Discord bot, especially on a host with access to internal HTTPS services. Exposure depends on whether members can reach the image-to-GIF command, which the description says is usually possible because the developer-only gate is disabled in normal deployments. Requests are limited to HTTPS on port 443 and cloud metadata over plain HTTP on another port is not reachable through this path.
No product ranges from the sources yet.
1.1.9 are affected.image to GIF command in your bot deployment and confirm whether the developer-only gate is enabled.1.1.9.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during validation and an internal address during the connection, bypassing the internal-address protection through DNS rebinding. The command takes its address directly from user input and its developer-only gate is disabled in normal deployments, so any member of a server with the bot can trigger the flaw without special permissions. Requests are restricted to HTTPS on port 443, and content is returned only when the response is a genuine image. The impact is therefore mostly blind internal probing with limited retrieval of image responses from loopback or internal endpoints, not arbitrary internal-data disclosure. Common cloud metadata services using plain HTTP on another port are not reachable through this path. This issue is fixed in version 1.1.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-61840")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.