CVE-2026-42595 Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Unauthenticated attackers can exploit SSRF in Gotenberg's Chromium endpoint to access internal resources or bypass deny-lists via redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42595?
CVE-2026-42595 is a high-severity server-side request forgery vulnerability in gotenberg, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks file:// URIs. An unauthenticated attacker can point Chromium at any internal IP — including loopback, RFC 1918 ranges, and cloud metadata endpoints — and receive the response rendered as a PDF. Additionally, even when operators configure a custom deny-list, the protection is bypassed via HTTP redirects. Gotenberg's Chromium instance follows 302 redirects from an attacker-controlled external URL to internal targets without re-validating the redirect destination against the deny-list. This vulnerability is fixed in 8.32.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-42595?
4 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v8 and github.com/gotenberg/gotenberg/v7. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.32.0 |
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
Products include Thecodingmachine Gotenberg.
How do I fix CVE-2026-42595?
Upgrade github.com/gotenberg/gotenberg/v8 to 8.32.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42595 exists.
Other vulnerabilities in gotenberg
Sources
Also known as GHSA-chwh-f6gm-r836, GO-2026-5324.