Incomplete List of Disallowed Inputs in gotenberg - CVE-2026-45741
Published: November 9, 2026
Vulnerability identifier: #VU162917
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45741
CWE-ID: CWE-184
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read internal cloud metadata and obtain IAM credentials.
The vulnerability exists due to Gotenberg's IsPublicIP misclassifying IPv6 transition and site-local addresses as public when WithDenyPrivateIPs(true) is enabled on dual-stack or NAT64-enabled hosts. An unauthenticated remote attacker can supply a crafted DNS AAAA record and request Chromium URL conversion to receive internal responses as a PDF.
Affected software
gotenberg
How to mitigate CVE-2026-45741
Install security update from vendor's website.
gotenberg - update to 8.33.0