TI-2026-30509 Aliases CVE-2026-42188 GHSA-xcfg-fcr5-gw9r

Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL

MEDIUM 53CWE-918Published 2026-05-11 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints. This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client. This vulnerability is fixed in 2.9.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00195 9th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Geyser (GeyserMC): 2.9.3org.geysermc.geyser:core (Maven): 2.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GeyserMC	Geyser	before 2.9.3	2.9.3	Patch available	CNA
—	org.geysermc.geyser:core (Maven)	before 2.9.3	2.9.3	Patch available	GHSA-xcfg-fcr5-gw9r

Geyser VendorGeyserMC Affected before 2.9.3 Fixed in 2.9.3 Patch available CNA
org.geysermc.geyser:core (Maven) Vendor— Affected before 2.9.3 Fixed in 2.9.3 Patch available GHSA-xcfg-fcr5-gw9r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:geysermc:geyser::::::::	before 2.9.3	Vulnerable	GeyserMC

cpe:2.3:a:geysermc:geyser:*:*:*:*:*:*:*:* Versions before 2.9.3 Vulnerable ·GeyserMC

Remediation

Fix · CNA Geyser (GeyserMC) Fixed in 2.9.3
Fix · GHSA-xcfg-fcr5-gw9r org.geysermc.geyser:core (Maven) Fixed in 2.9.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42188
2026-10-03 Alias added: GHSA-xcfg-fcr5-gw9r

References

TI-2021-16563 User impersonation due to incorrect handling of the login JWT CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences