CVE-2026-42188

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r	Exploit Vendor Advisory
https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Geyser es un puente entre Minecraft: Bedrock Edition y Minecraft: Java Edition. Antes de la 2.9.3, existe una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en el manejo de Geyser de los datos de textura de la cabeza del jugador de Bedrock. Al proporcionar una URL de textura de skin codificada en Base64 manipulada a través del comando /give, un atacante puede hacer que el servidor de Minecraft emita peticiones GET HTTP arbitrarias a puntos finales controlados por el atacante o internos. Esto ocurre del lado del servidor, sin una validación de URL adecuada, y puede ser activado por un cliente de Bedrock. Esta vulnerabilidad está corregida en la 2.9.3.

Information

Published : 2026-05-11 22:22

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42188

Mitre link : CVE-2026-42188

CVE.ORG link : CVE-2026-42188

JSON object : View

Products Affected

geysermc

geyser

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-42188", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42188", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:06:05.950736Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "GeyserMC", "product": "Geyser", "versions": [{"status": "affected", "version": "< 2.9.3"}]}]}], "published": "2026-05-11T22:22:11.277", "references": [{"url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser\u2019s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3."}, {"lang": "es", "value": "Geyser es un puente entre Minecraft: Bedrock Edition y Minecraft: Java Edition. Antes de la 2.9.3, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en el manejo de Geyser de los datos de textura de la cabeza del jugador de Bedrock. Al proporcionar una URL de textura de skin codificada en Base64 manipulada a trav\u00e9s del comando /give, un atacante puede hacer que el servidor de Minecraft emita peticiones GET HTTP arbitrarias a puntos finales controlados por el atacante o internos. Esto ocurre del lado del servidor, sin una validaci\u00f3n de URL adecuada, y puede ser activado por un cliente de Bedrock. Esta vulnerabilidad est\u00e1 corregida en la 2.9.3."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78C01578-7BAB-41D9-B09A-DA6AF76629B7", "versionEndExcluding": "2.9.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}