CVE-2026-82044 in UTMStack
Summary
by MITRE • 10/03/2026
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in UTMStack versions prior to 11.2.16 represents a critical server-side request forgery flaw within the application's reporting infrastructure. This security defect is specifically located in the PdfService.downloadPdf() method, which is exposed through the GET /api/generate-pdf-report endpoint. The core technical issue stems from an insufficient validation of user-supplied input parameters, particularly those defining the source URL for PDF generation. Because the system fails to rigorously sanitize or restrict these URLs before processing them, it allows authenticated users to manipulate the request destination arbitrarily. This lack of input validation creates a direct pathway for attackers to redirect internal server processes toward unintended targets within the network architecture.
From an operational perspective, this vulnerability enables significant data exfiltration and reconnaissance capabilities. An attacker with valid authentication credentials can leverage this flaw to force the web-pdf microservice to fetch content from sensitive internal backend endpoints that are not intended for public or even authenticated external access. Furthermore, the attack vector extends to critical infrastructure components such as OpenSearch clusters, which often store valuable log data and security events, as well as cloud instance-metadata services like AWS IMDS2 or Azure Instance Metadata Service. By directing requests toward these internal resources, attackers can retrieve configuration details, authentication tokens, database credentials, and other sensitive information that is typically protected by network segmentation and access controls designed to keep such metadata isolated from direct application-level interaction.
The impact of this vulnerability is severe due to the nature of the data returned in the PDF format. Since the server renders the fetched content into a downloadable document, any internal response containing secrets or proprietary information becomes directly accessible to the attacker through their browser interface. This effectively bypasses traditional network-based security controls that might restrict direct API access but do not account for application-level logic flaws where the server itself acts as an intermediary proxy. The ability to read instance metadata is particularly dangerous in cloud environments, as it can lead to full compromise of compute instances if combined with other exploitation techniques or credential theft from environment variables stored within that metadata service.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery (SSRF), specifically involving the lack of validation for user-controlled URLs used in server-side requests. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1557, Adversary-in-the-Middle, as it allows an attacker to position themselves between internal services and potentially intercept or manipulate traffic flow indirectly by forcing specific data retrieval. It also relates to T1046, Network Service Discovery, when used for mapping internal network structures through error responses or successful fetches of service banners.
To mitigate this risk, organizations running UTMStack versions before 11.2.16 must apply the vendor-provided patch immediately upon upgrade to version 11.2.16 or later. The fix involves implementing strict allow-listing for URLs permitted in the PdfService.downloadPdf() method, ensuring that only whitelisted domains and protocols are processed. Additionally, developers should enforce server-side validation that rejects requests targeting private IP ranges, loopback addresses, and cloud metadata service endpoints such as 169.254.169.254 or equivalent internal IPs. Network-level controls, including egress filtering on the web-pdf microservice container, can provide a defense-in-depth layer by blocking outbound connections to unauthorized internal subnets regardless of application-layer input validation failures.