CVE-2026-82044

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16

Description Authenticated attackers can perform a server-side request forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated url parameter to the downloadPdf() function within the PdfService, exposed via the GET '/api/generate-pdf-report' endpoint, attackers can force the web-pdf microservice to access internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service. This allows sensitive internal data to be retrieved and rendered into the resulting PDF file.

Recommendations Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the '/api/generate-pdf-report' endpoint or avoid using the url parameter until the update is applied.