CVE-2026-82044

Received Received - Intake

UTMStack SSRF in PdfService.downloadPdf Method

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-82044

EUVD

EUVD-2026-91799

Affected Vendors & Products

Vendor	Product	Version / Range
utmstack	utmstack	to 11.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

UTMStack before version 11.2.16 has a server-side request forgery (SSRF) vulnerability. This flaw allows authenticated attackers to manipulate the server into making requests to arbitrary internal resources by providing an unvalidated URL parameter to the PdfService.downloadPdf() method via the GET /api/generate-pdf-report endpoint. Attackers can force the web-pdf microservice to access internal backend endpoints, OpenSearch clusters, or cloud instance-metadata services, potentially exposing sensitive data rendered in the generated PDF.

Detection Guidance

Detect this vulnerability by monitoring network traffic for unusual requests to internal resources from the UTMStack server. Check logs for GET requests to /api/generate-pdf-report with unvalidated url parameters. Inspect PDF generation service logs for unexpected connections to backend endpoints or metadata services.

Impact Analysis

This vulnerability allows attackers to access internal resources and sensitive data that should not be exposed externally. If exploited, it could lead to unauthorized data exposure, internal network reconnaissance, or further attacks on backend systems. Organizations using affected UTMStack versions risk leaking confidential information through manipulated PDF reports.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations by exposing sensitive personal or health data. Unauthorized access to internal resources may result in data breaches, triggering legal penalties, reputational damage, and mandatory breach notifications under these regulations.

Mitigation Strategies

Immediately update UTMStack to version 11.2.16 or later to patch the vulnerability. Restrict access to the /api/generate-pdf-report endpoint by implementing authentication and authorization checks. Validate and sanitize all url parameters in the PdfService.downloadPdf() method to prevent server-side request forgery.

Hi! I’m here to help you understand CVE-2026-82044. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70