CVE-2026-42596 Scanner
CVE-2026-42596 Scanner - Server-Side Request Forgery (SSRF) vulnerability in Gotenberg
Used 5 times · 5.9k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-42596
9.4
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
gotenberg
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: gotenberg
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →