CVE-2026-45741

Executive Summary

CVE-2026-45741 is a server-side request forgery (SSRF) vulnerability in the Gotenberg document conversion API affecting versions 8.32.0 and earlier. The flaw resides in the IsPublicIP function within pkg/gotenberg/outbound.go, which fails to properly reject IPv6 transition prefixes — including 6to4, NAT64, Teredo, and deprecated site-local ranges — that can embed or route to non-public IPv4 destinations. An unauthenticated attacker can abuse a conversion route with WithDenyPrivateIPs enabled to reach internal cloud metadata services (e.g., 169.254.169.254) and exfiltrate the internal response as a PDF via the Chromium URL conversion route. The vulnerability carries a CVSS score of 7.5 (High) with a scope change indicating cross-system impact, and exploitation requires dual-stack or NAT64-enabled host network configuration.

Technical Analysis

Vulnerability Mechanism

The core vulnerability lies in the IsPublicIP function in pkg/gotenberg/outbound.go. This function is responsible for determining whether an IP address is considered "public" and thus safe for the outbound HTTP client to connect to when WithDenyPrivateIPs is enabled. The function fails to reject several IPv6 address categories:

1. 2002::/16 (6to4 prefix) — This prefix embeds an IPv4 address in the lower 32 bits. A 6to4 address of the form 2002:XXXX:XXXX:: can wrap an internal IPv4 address such as 169.254.169.254 (the AWS/GCP/Azure metadata service address).

2. 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64 prefixes) — These well-known prefixes embed IPv4 addresses in their final 32 bits. The 64:ff9b::7f00:1 address, for example, translates to 127.0.0.1, and 64:ff9b::a9fe:a9fe translates to 169.254.169.254.

3. fec0::/10 (deprecated site-local prefix) — Deprecated in RFC 3879, this prefix can route to internal destinations in some legacy network configurations.

4. Teredo (2001::/32) — Teredo tunneling embeds IPv4 addresses in a specific bit layout. A crafted Teredo address can encode an internal IPv4 destination.

5. Other transition prefixes — The function may also miss additional transition mechanisms that embed IPv4 addresses.

The addr.Unmap Defect

The codebase relies on the addr.Unmap operation to handle IPv4-mapped IPv6 addresses (e.g., ::ffff:192.168.1.1). However, addr.Unmap only converts IPv4-mapped IPv6 addresses (::ffff:0:0/96) back to their IPv4 form. It does NOT handle:

• IPv4-embedded IPv6 addresses in 6to4 format
• IPv4-embedded addresses in NAT64 format
• Teredo addresses
• Any other transition mechanism that encodes IPv4 within IPv6

This means a DNS AAAA record pointing to 2002:a9fe:a9fe:: (which wraps 169.254.169.254) will bypass the IsPublicIP check because the function sees only an IPv6 address that it does not recognize as private.

Attack Surface

The attack surface is the Gotenberg HTTP API, specifically the conversion routes. The affected route is the Chromium URL conversion route, which accepts a URL parameter and uses headless Chromium to convert the page at that URL into a PDF. When WithDenyPrivateIPs is enabled (the default in most deployments), the outbound HTTP client validates the target IP using IsPublicIP. The crafted DNS AAAA record causes this validation to pass, allowing the Chromium instance to fetch the internal metadata service response and render it as a PDF.

Exploitation Requirements

Exploitation requires the Gotenberg host to have:

• IPv6 connectivity (dual-stack) OR
• NAT64 translation in the network path

If the host network does not route the relevant IPv6 prefix, the attack fails because the crafted address is unreachable. This environmental dependency explains the AC:H (High Attack Complexity) in the CVSS vector.

Exploitation Scenarios

Note: No public PoC is currently available; the attack chain is inferred from the vulnerability class and NVD description.

Stage 1: Reconnaissance and Target Identification

An attacker identifies Gotenberg deployments by scanning for the API on port 3000 (default) or via Shodan queries (product:gotenberg). The attacker then probes the API for the presence of the Chromium URL conversion route by sending a test conversion request with a benign URL and observing the response. The attacker also determines whether the target host is dual-stack or NAT64-enabled by analyzing response headers or timing, or by querying known IPv6-only endpoints.

Step 2: Triggering the Flaw

The attacker crafts a malicious DNS AAAA record for a domain the attacker controls. The record resolves to an IPv6 address from a transition prefix that embeds the internal metadata IP address. For example:

• NAT64: 64:ff9b::a9fe:a9fe (embeds 169.254.169.254)
• 6to4: 2002:a9fe:a9fe:: (embeds 169.254.169.254)

The attacker sends a POST request to the conversion route with the crafted URL (e.g., http://attacker-controlled-domain/metadata). The outbound client resolves the AAAA record, and the IsPublicIP function evaluates the IPv6 address.

Step 3: Payload Execution

Because IsPublicIP treats the crafted IPv6 address as public, it permits the connection. The outbound HTTP client (through Chromium) connects to the address via the host's IPv6 network stack. The 6to4/NAT64/Teredo mechanism unwraps the embedded IPv4 address and routes the connection to 169.254.169.254, which is the cloud metadata service. The metadata service responds with instance credentials, user-data, or other sensitive cloud configuration (e.g., IMDSv1-compatible endpoints).

Step 4: Post-Exploitation Impact

The Chromium URL conversion route captures the metadata service response and renders it as a PDF document. The attacker downloads the resulting PDF, extracting:

• Cloud provider access tokens (if IMDSv1 is enabled, the response includes SecurityCredentials)
• SSH keys, user-data scripts, and network configuration
• IAM role credentials that can be used for lateral movement within the cloud environment

With the harvested credentials, the attacker can assume the IAM role of the compromised instance, granting access to other cloud resources (S3 buckets, databases, other EC2 instances) based on the attached IAM policy.

Impact Assessment

Business Impact

This vulnerability allows unauthenticated remote attackers to access cloud metadata services, potentially exfiltrating:

• Cloud IAM credentials and access tokens
• API keys and secrets in user-data
• Internal network configuration details
• Database credentials

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N indicates:

• Attack Vector: Network — remotely exploitable
• Attack Complexity: High — requires dual-stack/NAT64 environment
• Privileges Required: None — unauthenticated exploitation
• User Interaction: None — no victim actions required
• Scope: Changed — the compromised metadata service is outside the Gotenberg security boundary
• Confidentiality: High — direct credential disclosure
• Integrity: Low — potential limited modification of internal responses
• Availability: None — no direct denial of service

Affected Systems

• All Gotenberg deployments running version 8.32.0 and earlier
• Specifically deployments on:
  • Dual-stack (IPv4+IPv6) networks
  • NAT64-enabled networks
  • Cloud environments with metadata services (AWS, GCP, Azure, Alibaba Cloud)
• Docker-based deployments (Gotenberg is primarily distributed as a Docker image)

Blast Radius

The blast radius extends beyond the Gotenberg API container itself: successful exploitation compromises the cloud instance's IAM credentials, which can cascade to any resources accessible to that instance's role. This is reflected in the C (Changed) scope value in CVSS.

Detection Guidance

Sigma Rule

title: Gotenberg SSRF via IPv6 Transition Prefixes
id: 3d3c4e65-6d8a-4e5b-9b2a-0f8ec782eb57
status: experimental
description: Detects requests to Gotenberg conversion API with URLs resolving to IPv6 transition prefixes that could indicate SSRF exploitation
author: Valtersit Threat Intelligence
logsource:
    category: webserver
    product: gotenberg
detection:
    selection_convert:
        cs-method: POST
        cs-uri-query|contains:
            - '/forms/chromium/convert/url'
            - '/forms/url/convert'
    selection_ipv6_prefixes:
        cs-host|contains:
            - '2002:'      # 6to4
            - '64:ff9b:'   # NAT64 (well-known)
            - 'fec0:'      # deprecated site-local
            - '2001:'      # Teredo (if not whitelisted)
    condition: selection_convert and selection_ipv6_prefixes
    timeframe: 5m
falsepositives:
    - Legitimate use of IPv6 transition mechanisms in enterprise networks
    - Internal monitoring tools that legitimately use NAT64
level: high

YARA Rule

rule gotenberg_ssrf_ipv6_transition
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Gotenberg logs or packet captures containing IPv6 transition prefix abuse indicating CVE-2026-45741 exploitation"
        cve = "CVE-2026-45741"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "2002:a9fe:a9fe" nocase
        $b = "64:ff9b::a9fe:a9fe" nocase
        $c = "2002:c0a8" nocase        // 6to4 wrapping 192.168.x.x
        $d = "64:ff9b::c0a8" nocase     // NAT64 wrapping 192.168.x.x
        $e = "/forms/chromium/convert/url" ascii nocase
        $f = "WithDenyPrivateIPs" ascii nocase
        $g = "169.254.169.254" ascii nocase
    condition:
        any of ($a,$b,$c,$d) and any of ($e,$f) or
        ($g) and ($e)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"Gotenberg SSRF attempt via IPv6 transition prefix (CVE-2026-45741)";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/forms/chromium/convert/url";
    http.client_body; content:"http://";
    http.uri; pcre:"/[0-9a-fA-F]*:(2002|64:ff9b|fec0|2001):/";
    classtype:attempted-admin;
    sid:210045741;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

Elastic Detection

sequence by host.ip, process.pid with maxspan=1m
  [network where process.name == "chromium" and network.direction == "egress" and
   network.protocol == "ipv6" and
   destination.ip : ("2002:*", "64:ff9b:*", "fec0:*", "2001:*") and
   destination.ip : "2002:*"]
  [http where process.name == "chromium" and
   url.path : "/metadata*" or url.domain == "169.254.169.254"]

Splunk SPL Query

index=proxy OR index=docker sourcetype=gotenberg:access OR sourcetype=gotenberg:log
| where like(uri_path, "%/forms/chromium/convert/url%") AND like(url, "http://%")
| regex url="https?://.*(2002:|64:ff9b:|fec0:|2001:)"
| eval threat_indicator = "CVE-2026-45741-SSRF-IPv6-Transition"
| table _time, clientip, dst_host, uri_path, url, status
| sort - _time

Wazuh OSSEC Rule

<group name="gotenberg,">
    <rule id="100457" level="12">
        <decoded_as>json</decoded_as>
        <field name="program_name">gotenberg</field>
        <match>2002:|64:ff9b:|fec0:|2001:</match>
        <description>Gotenberg SSRF indicator: request containing IPv6 transition prefix (CVE-2026-45741)</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>ssrf,gotenberg,attack</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

The NVD description indicates the issue is fixed in version 8.33.0, but no official patch source or vendor advisory has been confirmed by our tracked sources at the time of writing. Exercise caution: validate the fix in your environment after upgrading.

1) Immediate Mitigations

• Upgrade to Gotenberg 8.33.0 (or later) if available from a trusted source. Verify the upgrade in a staging environment first.
• Disable IPv6 on the Gotenberg host (or its container) to remove the attack surface if the deployment does not require IPv6:

  sysctl -w net.ipv6.conf.all.disable_ipv6=1
  

  Or in Docker: add --sysctl net.ipv6.conf.all.disable_ipv6=1 to the container run command.
• Restrict network egress from the Gotenberg container using network policy (Kubernetes) or firewall rules. Deny outbound traffic to link-local addresses (e.g., 169.254.0.0/16), even when wrapped in IPv6, by adding explicit egress rules:

  ip6tables -A OUTPUT -d 2002:0:0:1::/64 -j DROP   # 6to4 internal ranges (adjust)
  ip6tables -A OUTPUT -d 64:ff9b::/96 -j LOG
  

• Disable the Chromium URL conversion route if not required for business operations. If using the REST API, remove the route from the router configuration or place a reverse proxy in front of Gotenberg that validates/allowlists target domains.
• Enforce IMDSv2 on cloud instances (AWS) to require session tokens, which makes SSRF exfiltration of credentials significantly harder. For AWS: aws ec2 modify-instance-metadata-options --instance-id <id> --http-tokens required.

2) Patch/Upgrade Steps

1. Confirm the affected version: gotenberg --version or check the Docker image tag (ghcr.io/gotenberg/gotenberg:8.32.0).
2. Obtain the patched image: docker pull ghcr.io/gotenberg/gotenberg:8.33.0 (or build from source at the 8.33.0 tag).
3. Deploy the updated image in a staging environment and run regression tests on all conversion routes.
4. Verify IsPublicIP now rejects the transition prefixes by sending a test request to a NAT64-wrapped internal IP in a sandbox environment.
5. Roll out to production, monitoring logs for anomalous IPv6 traffic.

3) Long-Term Hardening

• Network segmentation: Place Gotenberg in a dedicated network zone without direct access to cloud metadata services. Use a firewall/security group that denies egress to 169.254.169.254 and all link-local ranges.
• Egress filtering: Deploy a web application firewall (WAF) or API gateway in front of Gotenberg that enforces an allowlist of permitted target domains/URLs for conversion.
• DNS filtering: Restrict outbound DNS resolution from the Gotenberg container to approved resolvers only, and consider DNS rebinding protection mechanisms.
• Least privilege: Run Gotenberg containers with a non-root user, read-only filesystems, and network policies that permit only required egress.
• Security monitoring: Implement the detection rules above in your SIEM/IDS to identify exploitation attempts early.
• Regular security reviews: Subscribe to Gotenberg security advisories (GitHub releases) to stay informed of future patches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-45741
2. Gotenberg Official GitHub Repository: https://github.com/gotenberg/gotenberg — monitor for release 8.33.0 notes and security advisories.
3. Gotenberg Documentation: https://gotenberg.dev/docs/ — for deployment configurations and route reference (Chromium URL conversion route).
4. RFC 3879 (Deprecating Site Local Addresses): https://datatracker.ietf.org/doc/html/rfc3879 — background on the fec0::/10 prefix.
5. RFC 6052 (IPv6 Addressing of IPv4/IPv6 Translators — NAT64): https://datatracker.ietf.org/doc/html/rfc6052 — background on the 64:ff9b::/96 prefix.

Threat Actor Campaigns / Exploit in the Wild: As of this report, there are no known threat actor campaigns or evidence of exploitation in the wild. PoC status is Unknown; no public exploit code or Nuclei template has been identified. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS has not yet scored this vulnerability. Security teams should prioritize patching due to the criticality of the potential data exposure (cloud credentials) despite the lack of active exploitation evidence.