Gotenberg: Server-side request forgery vulnerability (CVE-2026-126799)
Gotenberg versions 8.31.0 through 8.37.x contain a server-side request forgery vulnerability in the IsPublicIP function, allowing unauthenticated attackers to bypass private IP restrictions via IPv6 zone identifiers to access internal network services.
CVE search metadata
CVE search record: CVE-2026-126799. Severity: high. CVSS: 7.5. KEV: no. Product: Gotenberg (8.31.0 - 8.37.x). Brief: Gotenberg: Server-side request forgery vulnerability (CVE-2026-126799). Brief link: https://feed.craftedsignal.io/briefs/2026-11-gotenberg-ssrf-cve-2026-126799/
Triage facts
Revision 1- Applicability
- Gotenberg (8.31.0 - 8.37.x)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Gotenberg versions 8.31.0 through 8.37.x are vulnerable to a server-side request forgery (SSRF) vulnerability due to improper validation within the IsPublicIP function. This flaw allows unauthenticated attackers to bypass private-IP deny-list protections by appending IPv6 zone identifiers (e.g., %25eth0) to URLs processed by the application, such as in downloadFrom, webhook, or Chromium/LibreOffice configurations.
Impact
Successful exploitation allows an attacker to bypass security restrictions and interact with internal network services that would otherwise be blocked. This enables the attacker to read responses from internal resources, which are subsequently returned within the generated PDF document.
Recommendation
Upgrade Gotenberg to version 8.38.0 or later immediately to patch CVE-2026-126799. As a temporary mitigation, restrict the ability of Gotenberg instances to reach internal network addresses or sensitive internal services through network-level firewall controls.
Immediate actions
Upgrade Gotenberg to version 8.38.0 or later.
Threat Hunt
Hunt for outbound requests originating from the Gotenberg server environment to internal IP ranges that contain URL query parameters with IPv6 zone identifiers (e.g., %25).
Data: Web server access logs, Proxy/Firewall egress logs
Mitigations
Apply egress filtering on the host running Gotenberg to block access to sensitive internal network segments.
CVE-2026-126799