CVE-2026-57485

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.9.0

Description The application injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests via the '/api/v1/pipeline/handleData' endpoint. This allows an authenticated user with ROLE USER privileges to retrieve the key using the '/api/v1/user/get-api-key' endpoint. Consequently, an attacker can impersonate the internal service account, bypass rate limits, and access restricted internal endpoints, specifically '/api/v1/info/requests/all' and '/api/v1/info/load/all'.

Recommendations Update to version 2.9.0.