{"id":"CVE-2026-82044","summary":"UTMStack \u003c 11.2.16 Server-Side Request Forgery via downloadPdf","details":"UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.","modified":"2026-10-04T07:05:11.964848Z","published":"2026-10-02T20:20:47.694Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82044.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82044.json"},{"type":"ADVISORY","url":"https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82044"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/utmstack-server-side-request-forgery-via-downloadpdf"},{"type":"FIX","url":"https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd"},{"type":"PACKAGE","url":"https://github.com/utmstack/UTMStack"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/utmstack/utmstack","events":[{"introduced":"0"},{"fixed":"a310ff00d4f699cf0ae687573f43b69ad9906cdb"},{"fixed":"4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"11.2.16"}]}}],"versions":["v11.2.15","v11.2.14","v11.2.13","v11.2.12","v11.2.11","v11.2.10","v11.2.9","v11.2.8","v11.2.7","v11.2.6","v11.2.5","v11.2.4","v11.2.3","v11.2.2","v11.2.1","v11.2.0","v11.1.8","v11.1.7","v11.1.6","v11.1.5","v11.1.4","v11.1.3","v11.1.2","v11.1.1","v11.1.0","v11.0.3","v11.0.2","v11.0.1","v11.0.0","v11.0.0-beta.2","v11.0.0-beta.1","v10.4.3-202405302135","v10.4.2-202405091759","v10.4.1-202405031218","v10.4.1-202405031709","v10.4.0-202404241632","v10.2.3-202402162310","v10.1.0-202312131645","v10.1.0-202311061514"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82044.json","vanir_signatures_modified":"2026-10-04T07:05:11Z","vanir_signatures":[{"target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java","function":"searchQueryBuilder"},"deprecated":false,"digest":{"function_hash":"68957226723480356561986649724453577436","length":2994},"id":"CVE-2026-82044-00f80de3","signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd"},{"signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java","function":"searchGroupsByFilter"},"deprecated":false,"digest":{"function_hash":"269564747755058024608506188991266501520","length":917},"id":"CVE-2026-82044-07391e93","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/a310ff00d4f699cf0ae687573f43b69ad9906cdb","target":{"file":"backend/src/main/java/com/park/utmstack/config/SecurityConfiguration.java","function":"configure"},"deprecated":false,"digest":{"function_hash":"70773812559973059244528242160102601958","length":3689},"id":"CVE-2026-82044-0793b236","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/web/rest/incident_response/UTMIncidentCommandWebsocket.java","function":"processCommand"},"deprecated":false,"digest":{"function_hash":"194282840324961909787801722715739979943","length":1480},"id":"CVE-2026-82044-4294df97"},{"digest":{"length":1220,"function_hash":"122915742089848104480121812621346897408"},"id":"CVE-2026-82044-4780dfe6","signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java","function":"searchPropertyValues"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["77603615067398617732982454417074115968","304720162881483557242953176377370407015","260776442570540419608668916007901239293","262102178570292902976957050882384933105","5133484940078305098189227038033073533","263277958095074705452565142646991028649","227581039705041739629317629530014128943","134473599757741699577048779550965553856","71466108699213875496886080697458899142","87786911152576521695650543567066976037","135355826422831744092394526397570149502","244654325976399233910958718223927104902","251793201619877621403247205321511205954"],"threshold":0.9},"id":"CVE-2026-82044-5deb7938","signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmNetworkScanService.java"}},{"signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/security/internalApiKey/InternalApiKeyFilter.java","function":"doFilterInternal"},"deprecated":false,"digest":{"length":795,"function_hash":"252342772753674335335270762340879727604"},"id":"CVE-2026-82044-6a696dc3","signature_type":"Function"},{"source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/security/internalApiKey/InternalApiKeyFilter.java"},"deprecated":false,"digest":{"line_hashes":["241115389385701311286308295943062964888","76201888586539675433739520760521457351","261236661973030783745185757318799114339","231012732014062826357513291716763460230","298941622871660510446773221493330129626","172411567710169248654347324730101481300","157215274910122719066831341524769260078","282970919829637986708352856687313473143","56511641352748286300733203307840306542","319863484281315374448378692454963485023","216615871232047482882774231037738458355","44870638661576000866040676905112114558","4233876062808691743390062311096270384","246908052710003740064611322348159714725","4323070435631480266204958908739082756","158987343302283832856824801036361737249","58979048005994418837395826113763732584","60047552708223396388281488984772081475","196923943742214301359447423096082991214","210638623208098108922079142945477430121","234489763707159543675782021424876966286"],"threshold":0.9},"id":"CVE-2026-82044-702c7130","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/idp_provider/IdentityProviderService.java"},"deprecated":false,"digest":{"line_hashes":["277039843628984667651694344387966319114","23668358656342241489460181213357334917","310918558045884477827052763127165867619","285454521102060390935400870517333241103","200888499468995779898647337043322223148","189458530986277879553087431244132497592","96318959497276070722390765069646232309","199402746966899601354456020533487009591","245168938035553143552106125998119538687","226412059791457723713196864340388154134","111501204007924803053680676712757688355","68474151969105336051116614703243405798","271815970607579177472625077476098408513","124437263763259485212241888798773767275","74760391624223906666366499671270148882","50007932177270992536116050006623892353","24068247171127542514218832625446638352","4483026928201441949587531436333086328","139276222224272416397991124107459273544","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-82044-72af4e36"},{"digest":{"function_hash":"21715359993335467388544530975700947048","length":764},"id":"CVE-2026-82044-81091f13","signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java","function":"paginateAndSort"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["55656280868562036959218950542431658586","155802045640653480201339051028028542201","284745671717788103914269017129057686491","261947612099601736708344571355368216831","9759751298826789821120752736318237593","245774701065037204139516583684738341968","153746669157542053600414596294431907957","85508958559698379461484898353092665670","239855418990530863508964515992809079924","251193954779579154980270933822911195927","205640138077953587150281572281945385728","178658191973704440316543671677129217542","138301922401647249022440471763611583307","148831703809696838842935755661676171225","199718222039456708886455612341404295624","288173854134558466866992639370079114656","58959099417506163983999528773981655395","759720683040077693387156971630218582","7574831424478313946649508111800537018","136783642486838001007693227115762087724","78644566948244470154787562967268655945"]},"id":"CVE-2026-82044-925dc6bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/util/PdfService.java"}},{"id":"CVE-2026-82044-94e7ed27","signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/idp_provider/IdentityProviderService.java","function":"validateMetadataUrl"},"deprecated":false,"digest":{"function_hash":"32396492999311826525356307162101200710","length":875}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/util/PdfService.java","function":"downloadPdf"},"deprecated":false,"digest":{"function_hash":"212541657921691813231161786274439366480","length":1318},"id":"CVE-2026-82044-9b18b619"},{"id":"CVE-2026-82044-bcbc599a","signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/service/network_scan/UtmAssetGroupService.java"},"deprecated":false,"digest":{"line_hashes":["170461039677711501334178069128019677421","3401771017735731825061292563379079810","261387076591306151502832519968014278455","256757536887397401392918940740419590189","277188335890058182537232285740602662233","165581889064784955137401457176080878314","179227681237092516613927473781687056516","29851811868030657649713053241261918471","148658634461367178990754064794143772013","131300027467541837514452301394165969195","303975401781444180210010108399950880225","215550974715414801837671602583966164589","112893919408313279852858888249889144541","257774632175408274051101139981074462979","171126406862393019244500554021960428805","107117810192417848763701541837764660220","13663826385241515065845300110866471083","197272913510299630801956516942694805154","230663873111406486356025192809036977500","38594800997881727573530205446395018118","55256096779567928781947751771342434876","94684015014019126152408051701184622764","178149395944589792708008294244785543821","8946013819474954028186090998507019859","296196032982810468579032964868328623126","245623271910960024966811782637423035012","131660213432666327881232600980883982438","18858285925719110998534355183255790228","192435357750973153079407594523792386937","126873467423546733089634590628196549503","235381625114333324875872605922488393389","142902171119534625869733233398687699730","189181004437945000930504869842004519283","98836481375444914081571104075629814642","173931244521340738203531176242047295299","158217824107783012308864330561525166962","184005022732245621151110924626562207730","108817327070015761144106336568364702145","74890120581430093459383767192852167452","226483864031302285450434363458042225913","18944254368952446308194441223988788568","9884300982209535692114794464338551279","145313502244303445711839817292934548324","197169255933424470690076989450064442175","34379051886614623691543370794094743387","216879131372612452624410396380885559453","103806376805593399755082591366182777923","15802898346175297641447624990014065838","123108243521830258810309452782617651436","66783889553409901717983066984448954955","237987917151888528874518718173802672395","314405980006118549730532247206740574053","273181242102623116769457378905337981832","245669837973920413622219619599618448973","126114700840759980330039103989282996039","238972273345145543423976708731578873908","80813088057124992137769293197925288935","32118268750087865183887736569806886889","175289753221613953552280069820931821418","119348768479635086767690364681059718717","90186939995202410078373764356704395802","75732232990598809370409507532972153424","118248706238056451436658937938692744011","232407023656820773380683096415522278794","24838716015293192799825009527642909513","224025494235650520393135159803101914569","132313197584908942114433343359477929982","170168216353539923718138953195353275213","27934368884670534498454909300857609777","332238180889592359516214813454353109422","92008252781943991993058250065751720314","323666141135752267656269940117495011102","221006074611266795876844427797044101795","30582041256451467405994339976199930330","299833960951009686327375785271114804343","176182327650921399671415361187662607711","254885914770556834404769940335512295140","214827608276759893772544067253528189658"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/web/rest/incident_response/UTMIncidentCommandWebsocket.java"},"deprecated":false,"digest":{"line_hashes":["103284467063735408960434712554076057548","32184795726974271460158294934079877428","58926678751707606193145524128815768052","110901320694948366001464244037974520348","338319468639382730601321932508553144428","103963464031165831410954753771933886733","249624847472728353050334293894912960453","162863961542199742852783999763095900698","330215521513084121184500998173092427078","237416822402843818144247785567912425122"],"threshold":0.9},"id":"CVE-2026-82044-bf8a31b2"},{"digest":{"line_hashes":["119281674686975875731770564032219692959","78417934313768657444876122361674007360","301640857188330599007503845765622088432","64100248194460746321534318893883868353","159508737171311465299931082978432811512","259289253056643582300184839775532838678","95892701269182895559018270523281688726","206679843760629120357119700617020291811","67364895523386518943973277506961632478","155592101035150071756891642905790812940","211976529167707917597169646786069468486","120236724691976339212976360999125805994","311918250049656819494207908605484250358","152626673150893568131945532291424565712","196236995951032327730232558783122303926"],"threshold":0.9},"id":"CVE-2026-82044-d1788db7","signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/web/rest/AccountResource.java"},"deprecated":false},{"digest":{"function_hash":"20522550395325152084216769065997637140","length":402},"id":"CVE-2026-82044-f13c5800","signature_type":"Function","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/4e7a727c3b8d8e2ad020d3b4f982a6d085dbecdd","target":{"file":"backend/src/main/java/com/park/utmstack/web/rest/AccountResource.java","function":"requestPasswordReset"},"deprecated":false},{"id":"CVE-2026-82044-f7b13804","signature_type":"Line","signature_version":"v1","source":"https://github.com/utmstack/utmstack/commit/a310ff00d4f699cf0ae687573f43b69ad9906cdb","target":{"file":"backend/src/main/java/com/park/utmstack/config/SecurityConfiguration.java"},"deprecated":false,"digest":{"line_hashes":["24314465636384831080084381857013409531","101145122101593491737521883455940834613","21943337672715565972139449547318075074","303463960373478848245061352223630480259"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}]}