CVE-2026-82044 UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
Authenticated attackers can exploit an unvalidated URL parameter to force the server to fetch internal resources, exposing sensitive data in generated PDFs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82044?
CVE-2026-82044 is a medium-severity server-side request forgery vulnerability in UTMStack, published on 2 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Weakness: CWE-918
Which versions are affected by CVE-2026-82044?
How do I fix CVE-2026-82044?
No fix has been published for CVE-2026-82044 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-82044 being exploited?
There is no known exploitation of CVE-2026-82044 in the wild and no public exploit code.
Sources
Also known as GHSA-hg4r-wjvj-4cww.