CVE-2026-40280 Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists
Attackers can bypass IP deny-lists via case-insensitive URL schemes to access internal services and cloud metadata in Gotenberg.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40280?
CVE-2026-40280 is a high-severity server-side request forgery vulnerability in gotenberg, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/.
This bypasses the same security control that was patched in CVE-2026-27018.
This issue has been fixed in version 8.31.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-40280?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.31.0 |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-40280?
Upgrade github.com/gotenberg/gotenberg/v8 to 8.31.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-40280 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40280 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in gotenberg
Sources
Also known as GHSA-5q7p-7jgv-ww56, GO-2026-5151.