Description

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other transition prefixes that can embed or route to non-public IPv4 destinations. The addr.Unmap operation only handles IPv4-mapped IPv6 addresses, so a crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination such as 169.254.169.254 as public. An unauthenticated attacker can use a conversion route with WithDenyPrivateIPs enabled to reach cloud metadata services, and the Chromium URL conversion route can return the internal response as a PDF, potentially exposing cloud credentials. Exploitation requires a deployment whose host routes the relevant IPv6 prefix, such as a dual-stack or NAT64-enabled environment. This issue is fixed in version 8.33.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T15:17:05.023Z",
  "pubdate": "2026-08-19T15:17:05.023Z",
  "executiveSummary": "Gotenberg versions 8.32.0 and earlier suffer from an outbound Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation of IPv6 addresses within the IsPublicIP function in pkg/gotenberg/outbound.go. The validation logic fails to reject specific transition, deprecated, and NAT64 prefixes that embed or route to non-public IPv4 destinations, such as cloud metadata endpoints. Because the addr.Unmap operation exclusively handles IPv4-mapped IPv6 addresses, an unauthenticated attacker can exploit this flaw by leveraging crafted DNS AAAA records to bypass private IP denial controls even when WithDenyPrivateIPs is enabled.\nThe impact includes unauthorized access to internal cloud metadata services, allowing the retrieval of sensitive cloud credentials. Successful exploitation results in the conversion route returning the internal response payload directly as a PDF document. Exploitation requires a deployment whose host infrastructure routes the relevant IPv6 prefixes, such as a dual-stack or NAT64-enabled network environment.",
  "technicalDetails": "The root cause of the vulnerability resides in the IsPublicIP function located within pkg/gotenberg/outbound.go of the Gotenberg application. When validating target destinations for outbound HTTP requests, the IP filtering logic fails to recognize and reject multiple specialized IPv6 address ranges that can encapsulate or route to private or internal IPv4 addresses. Specifically, the unvalidated ranges include the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the deprecated fec0::/10 site-local prefix, Teredo tunneling addresses, and other related transition prefixes.\nAdditionally, the implementation relies on the addr.Unmap operation, which is strictly limited to processing IPv4-mapped IPv6 addresses. It fails to correctly normalize or extract internal addresses encapsulated within other specialized IPv6 formats. Consequently, an unauthenticated attacker can supply a crafted DNS AAAA record pointing to a specially formatted IPv6 address that wraps a sensitive internal destination, such as the cloud metadata service IP address 169.254.169.254.\nThe attack flow proceeds as follows: First, an unauthenticated attacker submits a request to a conversion route in Gotenberg with WithDenyPrivateIPs enabled, providing a domain name resolving to the crafted malicious IPv6 AAAA record. Second, the vulnerable IsPublicIP function evaluates the target address, incorrectly classifies the encapsulated non-public destination as a legitimate public IP address, and permits the outbound connection. Third, the outbound HTTP client or Chromium URL conversion route connects to the internal resource, retrieves the restricted data (such as cloud credentials), and renders or returns the internal response payload directly as a PDF document to the attacker. Exploitation strictly requires a deployment environment where the host system actively routes the relevant IPv6 prefixes, such as dual-stack or NAT64-enabled configurations, affecting Gotenberg versions 8.32.0 and earlier."
}