{"id":"CVE-2026-126799","kind":"vulnerability","aliases":["CVE-2026-126799"],"related":[],"title":"Gotenberg: IPv6 zone identifiers bypass private-IP checks, enabling server-side request forgery","description":"Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF.","summary":"Gotenberg's private-IP deny list can be bypassed by appending an IPv6 zone identifier such as %25eth0 to a blocked address. An unauthenticated attacker can make the server fetch internal services and read the responses inside the returned PDF.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","gotenberg","package","self-hosted"],"not_affected_if":["no-user-supplied-urls","version-8.38.0-or-later"],"how_to_check":"- Check the running Gotenberg version (for example with `gotenberg --version` or the container image tag); versions `8.31.0` through `8.37.x` are in the affected range.\n- Look for Gotenberg exposed to untrusted users with `downloadFrom`, webhook, or Chromium/LibreOffice URL inputs enabled.","fix":"- Gotenberg: upgrade to `8.38.0` or later.","status":"open","published_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","triaged_at":"2026-11-11T21:30:45+00:00","updated_at":"2026-11-11T21:30:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T21:30:45Z","model":"claude-haiku-5-5","output":{"fix":"- Gotenberg: upgrade to `8.38.0` or later.","reach":"internet","title":"Gotenberg: IPv6 zone identifiers bypass private-IP checks, enabling server-side request forgery","impact":"medium","summary":"Gotenberg's private-IP deny list can be bypassed by appending an IPv6 zone identifier such as %25eth0 to a blocked address. An unauthenticated attacker can make the server fetch internal services and read the responses inside the returned PDF.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gotenberg","self-hosted","docker"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"internal services reachable and their responses read from PDF","analyst_note":"","how_to_check":"- Check the running Gotenberg version (for example with `gotenberg --version` or the container image tag); versions `8.31.0` through `8.37.x` are in the affected range.\n- Look for Gotenberg exposed to untrusted users with `downloadFrom`, webhook, or Chromium/LibreOffice URL inputs enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.38.0-or-later","no-user-supplied-urls"],"who_is_affected":"Teams running Gotenberg 8.31.0 up to but not including 8.38.0 that accept URLs from users or untrusted sources in downloadFrom, webhook, or Chromium/LibreOffice inputs are exposed. Instances reachable only by trusted internal callers with fixed URLs are less exposed. Teams on 8.38.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000784,"input_tokens":4696,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126799':18A,21A '-2026':17A,20A '25eth0':46B,107C '8.31.0':70C '8.38.0':72C 'address':50B,111C 'allow':84C 'append':39B,102C 'attack':53B,86C,100C 'block':49B,113C 'bypass':5A,37B,88C 'check':9A 'chromium/libreoffice':120C 'contain':73C 'cve':16A,19A 'deni':33B,93C 'deny-list':92C 'docker':22B 'downloadfrom':117C 'enabl':10A 'fetch':58B 'forgeri':15A,79C 'gotenberg':1A,23B,28B,69C 'host':27B 'identifi':4A,43B,99C 'insid':65B 'intern':59B,124C 'ip':8A,32B,91C 'ipv6':2A,41B,97C,114C 'ispublicip':82C 'list':34B,94C 'make':55B 'packag':24B 'pdf':68B,132C 'prefix':115C 'privat':7A,31B,90C 'private-ip':6A,30B,89C 'protect':95C 'reach':123C 'read':62B,127C 'request':14A,78C 'respons':64B,128C 'return':67B,131C 'self':26B 'self-host':25B 'server':12A,57B,76C 'server-sid':11A,75C 'servic':60B,125C 'side':13A,77C 'unauthent':52B,85C 'unspecifi':110C 'url':121C 'use':96C 'vulner':80C 'webhook':118C 'zone':3A,42B,98C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams running Gotenberg 8.31.0 up to but not including 8.38.0 that accept URLs from users or untrusted sources in downloadFrom, webhook, or Chromium/LibreOffice inputs are exposed. Instances reachable only by trusted internal callers with fixed URLs are less exposed. Teams on 8.38.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","gotenberg","high","package","selfhosted"],"campaign_type":null,"search_a":"'-126799':18A,21A '-2026':17A,20A 'bypass':5A 'check':9A 'cve':16A,19A 'enabl':10A 'forgeri':15A 'gotenberg':1A 'identifi':4A 'ip':8A 'ipv6':2A 'privat':7A 'private-ip':6A 'request':14A 'server':12A 'server-sid':11A 'side':13A 'zone':3A","search_b":"'25eth0':46B 'address':50B 'append':39B 'attack':53B 'block':49B 'bypass':37B 'deni':33B 'docker':22B 'fetch':58B 'gotenberg':23B,28B 'host':27B 'identifi':43B 'insid':65B 'intern':59B 'ip':32B 'ipv6':41B 'list':34B 'make':55B 'packag':24B 'pdf':68B 'privat':31B 'private-ip':30B 'read':62B 'respons':64B 'return':67B 'self':26B 'self-host':25B 'server':57B 'servic':60B 'unauthent':52B 'zone':42B","search_c":"'25eth0':107C '8.31.0':70C '8.38.0':72C 'address':111C 'allow':84C 'append':102C 'attack':86C,100C 'block':113C 'bypass':88C 'chromium/libreoffice':120C 'contain':73C 'deni':93C 'deny-list':92C 'downloadfrom':117C 'forgeri':79C 'gotenberg':69C 'identifi':99C 'intern':124C 'ip':91C 'ipv6':97C,114C 'ispublicip':82C 'list':94C 'pdf':132C 'prefix':115C 'privat':90C 'private-ip':89C 'protect':95C 'reach':123C 'read':127C 'request':78C 'respons':128C 'return':131C 'server':76C 'server-sid':75C 'servic':125C 'side':77C 'unauthent':85C 'unspecifi':110C 'url':121C 'use':96C 'vulner':80C 'webhook':118C 'zone':98C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T07:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126799","severity":null,"published_at":"2026-11-11T21:16:43+00:00","modified_at":"2026-11-11T21:16:43+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","fetched_at":"2026-11-11T21:29:07+00:00","note":null}],"documents":[{"id":128959,"url":"https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128960,"url":"https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128961,"url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T07:18:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128962,"url":"https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}