What happened

• CVE-2026-42589 is a remote code execution flaw in Gotenberg, rated CVSS 9.8, and was patched in May 2026 [S1].
• VulnCheck reports threat actors exploiting it to deliver a Go-based reverse shell named cache_base [S1].
• The activity reportedly began from a residential Japanese IP in early October 2026 [S1].
• VulnCheck counted 1,358 exploitation events from 128 unique source IPs over the past 30 days [S1].

Timeline

Detect

Unexpected child process of Gotenberg · EDR / Sysmon process creation on Gotenberg hosts or containers

index=* (parent_process_name="*gotenberg*" OR ParentImage="*gotenberg*") (process_name IN ("sh","bash","dash","curl","wget","cache_base") OR Image IN ("*/sh","*/bash","*/dash","*/curl","*/wget","*cache_base*")) | stats count min(_time) as first max(_time) as last values(process) as cmd by host, parent_process_name, process_name

FROM logs-* | WHERE TO_LOWER(process.parent.name) LIKE "*gotenberg*" OR TO_LOWER(process.parent.executable) LIKE "*gotenberg*" | WHERE process.name IN ("sh", "bash", "dash", "curl", "wget", "cache_base") OR process.executable LIKE "*/sh" OR process.executable LIKE "*/bash" OR process.executable LIKE "*/dash" OR process.executable LIKE "*/curl" OR process.executable LIKE "*/wget" OR process.executable LIKE "*cache_base*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmd = VALUES(process.command_line) BY host.name, process.parent.name, process.name | SORT count DESC

A hit means: Gotenberg launched a shell, a downloader or cache_base. That fits the reported exploit chain and needs host triage [S1].

cache_base artefact anywhere · EDR process, file and network telemetry

index=* "cache_base" | stats count min(_time) as first max(_time) as last by host, source

FROM logs-* | WHERE process.name LIKE "*cache_base*" OR process.executable LIKE "*cache_base*" OR process.command_line LIKE "*cache_base*" OR file.path LIKE "*cache_base*" OR file.name LIKE "*cache_base*" OR process.parent.executable LIKE "*cache_base*" OR message LIKE "*cache_base*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, event.dataset | SORT count DESC

A hit means: The reported reverse shell name appears on a host. Confirm it is the binary and not an unrelated string [S1].

Verify

• Confirm the parent chain leads back to the Gotenberg service, and check for an outbound connection from the child process to an external IP.
• Hash any cache_base binary and check whether it is a Go executable. Then compare it with VulnCheck indicators once they are obtained.
• Benign look-alikes: Gotenberg normally launches its own conversion helper processes. Baseline those before alerting, because the sources do not list them.
• The string 'cache_base' can match ordinary cache paths. Require a process or file match, not text alone.

Scope

Affected

• Gotenberg versions before the May 2026 fix for CVE-2026-42589 [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Fixed in: Patched in May 2026 (version not stated in source) [S1]

Enumerate

• All Gotenberg deployments, including containers, images and sidecars, and their versions
• Which instances are reachable from the internet or from untrusted networks
• Applications and service accounts that call Gotenberg
• Gotenberg request logs since early October 2026

Contain

• Remove internet exposure or restrict access to Gotenberg to known callers.
• Before stopping any suspected host, snapshot it: container, memory if feasible, and logs.
• Block outbound connections from Gotenberg hosts except those the service needs.
• Isolate any host with a cache_base hit. Killing the process loses its in-memory state, so capture that first.

Eradicate

• Upgrade Gotenberg to the May 2026 patched release [S1].
• Rebuild compromised containers or hosts from clean images rather than cleaning them in place.
• Rotate secrets that were reachable from compromised Gotenberg hosts.

Recover

• Before restoring, confirm the patched version is running and that the instance is not internet-exposed.
• Afterwards, monitor for Gotenberg child processes and new outbound connections.

Re-enter the loop when

• VulnCheck or the Gotenberg maintainers publish IoCs, a fixed version number or exploit details.
• A cache_base hash or C2 address becomes available.
• Evidence shows the attackers moving beyond the Gotenberg host.
• The advisory changes the affected versions.

Debrief

• Record Gotenberg inventory gaps, its exposure and how long it ran unpatched after May 2026.
• Gap: the sources give no fixed version, no IoCs, no C2 details and no exploit vector.
• Gap: the claims come from a roundup, not VulnCheck's own report.

Detection coverage — checked automatically

Checked automatically 2026-11-10 21:16Z from public sources: 4 published, 23 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-42589 — Gotenberg CVE-2026-42589 RCE reportedly exploited to deploy Go reverse shell 'cache_base'. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-42589

cpe:"cpe:/a:thecodingmachine:gotenberg"

product:"Gotenberg"

host.services: (software.product = "Gotenberg")

http.title:"Gotenberg"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 21:16Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which Gotenberg version fixes CVE-2026-42589?
• What is the exploit vector: which endpoint and which input?
• What are the cache_base hashes, C2 addresses and the registration protocol?
• Where is VulnCheck's primary report?
• What are Gotenberg's normal child processes for baselining?

Sources

• [S1] https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.