# CVE-2026-40280: Gotenberg - SSRF

> Live exploitation tracking for CVE-2026-40280 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-40280

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.8
- **Public exploit available:** Yes
- **Affected products:** Gotenberg
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application, go

## Description

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/. 

This bypasses the same security control that was patched in CVE-2026-27018.

This issue has been fixed in version 8.31.0.

## CrowdSec analysis

[CVE-2026-40280](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-40280) is a server-side request forgery (SSRF) vulnerability in Gotenberg 8.30.1 and earlier that allows unauthenticated attackers to bypass private-IP deny-lists by using mixed- or uppercase URL schemes. Successful exploitation can expose internal services, loopback systems, private network resources, and cloud instance metadata endpoints, potentially enabling reconnaissance and access to sensitive internal information. The issue is fixed in Gotenberg 8.31.0.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-40280 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2026-40280 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target Gotenberg’s `/forms/chromium/convert/html` endpoint and abuse the multipart `downloadFrom` parameter to induce server-side requests to attacker-controlled or internal URLs. Mixed-case schemes such as `HTTP://` or `HTTPS://` can bypass case-sensitive deny-lists, enabling unauthenticated access to private services, loopback addresses, and cloud metadata endpoints.

## Timeline

- 2026-05-05: CVE Published. CVE-2026-40280 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2026-40280 exploitation attempts against the CrowdSec Network.
- 2026-08-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-40280 for the first time.

## References

- https://github.com/advisories/GHSA-jjwv-57xh-xr6r
- https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47
- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40280.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-40280) follows observed exploitation activity for CVE-2026-40280. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.