CVE-2026-82044: UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send requests to the GET /api/generate-pdf-report endpoint. No user interaction is required.
What resources could be exposed through the vulnerable endpoint?
The vulnerable url parameter can cause the web-pdf microservice to request arbitrary internal resources, including internal backend endpoints, the OpenSearch cluster, and cloud instance-metadata services. Sensitive data retrieved this way may be rendered into the returned PDF.
Which versions need remediation?
UTMStack versions before 11.2.16 are affected. Version 11.2.16 is identified as the release containing the fix.