Executive brief
Gotenberg, a tool used to convert various document formats into PDFs, is vulnerable to a security bypass that allows attackers to access internal network services. By using specially crafted network addresses, an unauthorized user can trick the system into connecting to sensitive internal resources, such as cloud metadata services. This could lead to the theft of administrative credentials or other private data from the server's environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gotenberg's 'IsPublicIP' function within 'pkg/gotenberg/outbound.go'. The function relies on Go standard library helpers that fail to identify certain IPv6 prefixes (such as 6to4, NAT64, and deprecated site-local addresses) as non-public. An unauthenticated attacker can use a crafted DNS AAAA record to bypass IP-based deny-lists. On dual-stack or NAT64-enabled hosts, these addresses are transparently routed to internal IPv4 destinations like the AWS/GCP/Azure Instance Metadata Service (169.254.169.254), potentially allowing for credential theft. As of the advisory, no patched version is specified, but a fix involving explicit prefix checks is suggested.
Affected products
- Gotenberg Gotenberg <= 8.32.0
Timeline
- 2026-05-29: disclosed
- 2026-05-29: advisory