CVE-2026-42596Disclosure(thecodingmachine / gotenberg)

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch thecodingmachine gotenberg systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.

thecodingmachine CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gotenberg

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-14); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

thecodingmachine

Products

gotenberg

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot39d
Disclosure
🚨 CVE-2026-42596 - critical 🚨 Gotenberg < 8.31.0 - Server-Side Request Forgery > Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to in... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-42596 @pdnuclei #NucleiTemplates #cve
Post summary
A critical SSRF vulnerability (CVE‑2026‑42596) impacting Gotenberg versions prior to 8.31.0 has been disclosed via a Project Discovery library link, but no PoC, exploit, patch, or active exploitation details are provided.
0201521.2K
1.3K followersView on X
Kaitan ID Security@KaitanSecurity147d
Disclosure
🚨 CRITICAL — CVE-2026-42596 Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's … CVSS 9.4 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-42596 #Docker #CyberSecurity #InfoSec
Post summary
A critical CVE-2026-42596 affecting Gotenberg (CVSS 9.4) is announced, noting no patch has yet been released and linking to a detailed analysis.
0000042
90 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	thecodingmachine	gotenberg	-	-	-

Explore more

Back to dashboard thecodingmachine CVEs gotenberg vulnerabilities