CVE-2026-39383: Gotenberg SSRF Vulnerability

CVE-2026-39383 Overview

CVE-2026-39383 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Gotenberg, an API-based document conversion tool. The flaw exists in version 8.29.1, where the FilterDeadline function in filter.go returns nil unconditionally when both the allow-list and deny-list are empty, which is the default configuration. An unauthenticated attacker with network access can supply a crafted URL in the Gotenberg-Webhook-Url request header to force the server to issue outbound HTTP POST requests to arbitrary destinations.

Critical Impact
Remote unauthenticated attackers can pivot through Gotenberg to probe internal networks, reach cloud metadata endpoints, and trigger side-effects on internal services.

Affected Products

Gotenberg version 8.29.1
Gotenberg deployments running default webhook configuration
Gotenberg instances exposed to untrusted network clients

Discovery Timeline

2026-05-05 - CVE-2026-39383 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-39383

Vulnerability Analysis

Gotenberg accepts a Gotenberg-Webhook-Url header that instructs the server where to POST converted documents. The FilterDeadline function in filter.go is responsible for validating these URLs against an allow-list and deny-list. When both lists are empty, which is the default, the function returns nil and accepts any URL without restriction.

This condition produces a blind SSRF. Gotenberg posts the converted document to the supplied URL and inspects only the response status code. The target's response body is never returned to the requester. Attackers infer behavior from whether the error callback fires, allowing reconnaissance of internal infrastructure and reachability checks against cloud metadata services such as 169.254.169.254.

Root Cause

The root cause is missing default-deny logic in FilterDeadline. When operators do not explicitly configure GOTENBERG_API_WEBHOOK_ALLOW_LIST or GOTENBERG_API_WEBHOOK_DENY_LIST, the filter accepts every URL, including RFC-1918 private addresses, link-local ranges, and loopback destinations.

Attack Vector

The attack requires only network access to the Gotenberg HTTP API. The attacker submits a conversion request with a Gotenberg-Webhook-Url header pointing at an internal target. Gotenberg performs the conversion and dispatches a POST to the attacker-specified destination. The retryable HTTP client issues up to four automatic retries per request, amplifying every probe and increasing the chance of triggering side-effects on idempotent-unsafe endpoints.

No authentication, user interaction, or special privileges are required. See the GitHub Security Advisory GHSA-5vh4-rgv7-p9g4 for full technical details.

Detection Methods for CVE-2026-39383

Indicators of Compromise

Inbound HTTP requests to Gotenberg containing the Gotenberg-Webhook-Url header referencing RFC-1918, loopback, or link-local destinations.
Outbound POST requests from Gotenberg hosts to internal services, cloud metadata endpoints such as 169.254.169.254, or unexpected external hosts.
Repeated webhook callback errors in Gotenberg logs corresponding to bursts of four retry attempts per probe.

Detection Strategies

Inspect Gotenberg access logs for Gotenberg-Webhook-Url header values that resolve to private, loopback, or metadata IP ranges.
Correlate Gotenberg egress traffic with conversion request timestamps to identify webhook-driven SSRF attempts.
Alert on outbound POST traffic from document-conversion workloads to non-approved destinations.

Monitoring Recommendations

Enable network flow logging on subnets hosting Gotenberg and forward records to a central analytics platform for review.
Monitor for accesses to cloud instance metadata services originating from Gotenberg containers or pods.
Track HTTP 4xx and 5xx response patterns from Gotenberg's webhook client that indicate scanning behavior.

How to Mitigate CVE-2026-39383

Immediate Actions Required

Upgrade Gotenberg to version 8.31.0, which contains the fix for FilterDeadline.
Restrict network egress from Gotenberg hosts to only approved webhook receivers using firewall rules or service mesh policies.
Place Gotenberg behind authenticated reverse proxies and block external clients from supplying the Gotenberg-Webhook-Url header.

Patch Information

The issue is fixed in Gotenberg version 8.31.0. Operators should pull the updated container image or binary and redeploy. Refer to the GitHub Security Advisory for release notes and verification details.

Workarounds

Set GOTENBERG_API_WEBHOOK_ALLOW_LIST to a regular expression matching only trusted webhook receivers.
Set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918, loopback, and link-local ranges including 169.254.0.0/16.
Enforce egress filtering at the network layer to prevent Gotenberg from reaching internal services or cloud metadata endpoints.

bash

# Configuration example
export GOTENBERG_API_WEBHOOK_ALLOW_LIST='^https://webhook\.example\.com/.*$'
export GOTENBERG_API_WEBHOOK_DENY_LIST='^https?://(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.|::1|fe80:).*'