CVE-2026-42188 GeyserMC CVE debrief

Who should care

Administrators of Geyser instances, particularly those exposed to untrusted clients or networks, should be aware of this vulnerability. They should review and restrict /give command usage, monitor for suspicious HTTP requests, and prioritize patching for exposed Geyser instances. Additionally, security teams and vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators of Minecraft servers using Geyser should also take note of this vulnerability and take necessary precautions to protect their systems. This may involve reviewing compensating controls for exposed systems while remediation is scheduled and verified. Affected platform operators must consider the operational impact of this vulnerability and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also check relevant monitoring, detection, and logs for exposed assets that need extra review and assign an owner for follow-up. Asset inventory management will help identify potentially affected systems for further review. Rolling back change windows may be necessary if patching is not immediately feasible. Source tracking can help verify the effectiveness of mitigations and patches. Overall, a coordinated effort between administrators, security teams, and operators is necessary to address this vulnerability effectively. The executive overview of this vulnerability highlights the need for a thorough review of affected systems and prompt patching to prevent potential exploitation. The likely operational impact of this vulnerability is relatively low due to its limited attack surface, but it still requires attention from affected parties to prevent potential issues. The source-confidence limits of this vulnerability are relatively high due to its documentation in official CVE and NVD sources. The review context of this vulnerability indicates that it is a low-priority vulnerability that requires attention from administrators and security teams. However, it does not require immediate action unless exposed Geyser instances are present in the environment. In

Technical summary

A server-side request forgery (SSRF) vulnerability exists in Geyser's handling of Bedrock player head texture data prior to version 2.9.3. An attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints by supplying a crafted Base64-encoded skin texture URL via the /give command. This vulnerability is fixed in version 2.9.3. The vulnerability has a low CVSS score of 2.4 and is considered a low-priority vulnerability with limited attack surface.

Defensive priority

Low-priority vulnerability with limited attack surface; prioritize patching for exposed Geyser instances.

Recommended defensive actions

• Patch Geyser to version 2.9.3 or later
• Review and restrict /give command usage
• Monitor for suspicious HTTP requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from official CVE and NVD sources indicates a low-severity SSRF vulnerability in Geyser versions prior to 2.9.3. The vulnerability allows for arbitrary HTTP GET requests to be issued server-side. Patching to version 2.9.3 or later is recommended. Defenders should verify exposed Geyser instances, review /give command usage, and monitor for suspicious HTTP requests. Additional verification tasks include checking relevant monitoring, detection, and logs for exposed assets that need extra review.

Official resources