Executive brief
Geyser, a bridge that allows Bedrock Edition players to join Java Edition Minecraft servers, is vulnerable to a security flaw where an attacker can force the server to make unauthorized web requests. By using a specially crafted player head item, an attacker can trick the server into connecting to internal network services or cloud metadata endpoints that are normally hidden. This could allow an attacker to map out a server's private network or discover sensitive configuration details about the server's hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Geyser's handling of the minecraft:profile NBT structure for player heads. When a Bedrock client provides a Base64-encoded skin texture URL via the /give command, Geyser fails to sufficiently validate the URL before resolution. An attacker with high privileges (ability to use the /give command) can supply a crafted URL to force the Minecraft server to issue HTTP GET requests to internal or external endpoints. While this is a blind SSRF (no response data is returned to the attacker), it can be used for internal network probing, cloud metadata access (e.g., 169.254.169.254), and IP address disclosure. The issue is fixed in version 2.9.3.
Affected products
- GeyserMC Geyser <= 2.9.2
Timeline
- 2026-04-25: disclosed: Initial disclosure to GeyserMC/Geyser
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: advisory: NVD publication