CVE-2026-42188 Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL
Attackers can force the Minecraft server to make arbitrary HTTP requests via crafted player head texture URLs, potentially accessing internal services.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42188?
CVE-2026-42188 is a low-severity server-side request forgery vulnerability in GeyserMC Geyser, published on 11 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-42188?
2 open source packages ship an affected version, including org.geysermc.geyser:core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.geysermc.geyser:core Maven | All versions | 2.9.3 |
org.geysermc.geyser:core Maven | All versions | 2.9.3 |
Products include Geysermc Geyser.
How do I fix CVE-2026-42188?
Upgrade org.geysermc.geyser:core to 2.9.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42188 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42188 exists.
Other vulnerabilities in GeyserMC Geyser
Sources
Also known as GHSA-xcfg-fcr5-gw9r.