CVE-2026-42595: Gotenberg SSRF and redirect bypass in Chromium URL-to-PDF endpoint

CVE-2026-42595 · Severity: high · CVSS 8.6 · Published 2026-05-14

Gotenberg is a tool used to convert web pages and documents into PDF files. A security flaw allows unauthorized users to force the tool to access internal network resources, such as private company servers or cloud metadata services that contain sensitive credentials. This could lead to the theft of administrative credentials or the exposure of private internal data, which is then returned to the attacker in the form of a PDF document.

Technologies: github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go), Gotenberg. Vendors: Go, Gotenberg.

Quick answers

Is CVE-2026-42595 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42595 being exploited in the wild.
How severe is CVE-2026-42595?
High severity, with a CVSS score of 8.6, published 14 May 2026.
Which products and versions are affected?
github.com/gotenberg/gotenberg/v7 (Go) SEMVER:introduced=0; github.com/gotenberg/gotenberg/v8 (Go) < 8.32.0, SEMVER:introduced=0,fixed=8.32.0; Gotenberg < 8.32.0.
Is there a fix for CVE-2026-42595?
Yes. github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42595 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42595?
Check whether you run github.com/gotenberg/gotenberg/v7 (Go), github.com/gotenberg/gotenberg/v8 (Go) or Gotenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gotenberg/gotenberg/v8 (Go): upgrade to 8.32.0 or later
    go get github.com/gotenberg/gotenberg/v8@v8.32.0

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url). The default configuration only includes a deny-list for 'file://' URIs, failing to restrict HTTP/HTTPS requests to loopback addresses, RFC 1918 private ranges, or cloud metadata endpoints (e.g., 169.254.169.254). Furthermore, the application fails to re-validate destinations during HTTP redirects; an attacker can provide a URL to a malicious external server that redirects the Chromium instance to an internal target, bypassing even custom deny-lists. This allows unauthenticated remote attackers to exfiltrate sensitive internal data rendered as PDF documents. The issue is resolved in version 8.32.0.

Affected products

  • Gotenberg Gotenberg < 8.32.0

Identifiers

  • CVE-2026-42595
  • GHSA-chwh-f6gm-r836
  • GO-2026-5324

Timeline

  • 2026-04-30: disclosed: Original advisory published on GitHub
  • 2026-05-14: advisory: NVD published the CVE record
  • 2026-05-14: patched: Fix released in version 8.32.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.