CVE-2026-42188: Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

May 5, 2026 (updated May 13, 2026)

A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client.

References

github.com/GeyserMC/Geyser/security/advisories/GHSA-xcfg-fcr5-gw9r
github.com/advisories/GHSA-xcfg-fcr5-gw9r
nvd.nist.gov/vuln/detail/CVE-2026-42188

Code Behaviors & Features

Detect and mitigate CVE-2026-42188 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →