Is CVE-2026-126799 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126799 being exploited in the wild.

How severe is CVE-2026-126799?

High severity, with a CVSS score of 7.5, published 11 November 2026.

Which products and versions are affected?

Gotenberg 8.31.0 before 8.38.0.

Is there a fix for CVE-2026-126799?

Yes: fixed in 8.38.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126799 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-126799?

Check whether you run Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126799: Gotenberg server-side request forgery in IsPublicIP IPv6 handling

CVE-2026-126799 · Severity: high · CVSS 7.5 · Published 2026-11-11

Gotenberg, a document conversion service, fails to properly validate IPv6 addresses when classifying them as public or private. An attacker can exploit this by appending IPv6 zone identifiers (like %eth0) to internal IP addresses, bypassing the server's protections and reaching internal services through downloadFrom URLs, webhooks, or Chromium/LibreOffice conversion parameters, with responses leaked in generated PDFs.

Technologies: Gotenberg. Vendors: Gotenberg.

Quick answers

Is CVE-2026-126799 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126799 being exploited in the wild.
How severe is CVE-2026-126799?: High severity, with a CVSS score of 7.5, published 11 November 2026.
Which products and versions are affected?: Gotenberg 8.31.0 before 8.38.0.
Is there a fix for CVE-2026-126799?: Yes: fixed in 8.38.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126799 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-126799?: Check whether you run Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.38.0

Technical details

The IsPublicIP() function in outbound.go fails to strip IPv6 zone identifiers before checking against public IP deny-lists. An attacker can craft requests with URLs like http://[::1%eth0]/ or http://[::%1]/ to bypass private-IP protections and trigger server-side requests to internal services. The vulnerability affects versions 8.31.0 through 8.37.0 and requires no authentication.

Affected products

Gotenberg Gotenberg 8.31.0 before 8.38.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.