CVE-2026-55864
highpriority · track · 0EPSS 0.006 · 48 %ileDEUSEPSS · scored 2026-10-27
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.5–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
- Maven org.geonetwork-opensource:gn-web-app4.0.0 → 4.2.17osvUSpkg:maven/org.geonetwork-opensource/gn-web-app
- Maven org.geonetwork-opensource:gn-web-app4.4.0 → 4.4.12osvUSpkg:maven/org.geonetwork-opensource/gn-web-app
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3299GeoNetwork: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-09-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GeoNetwork ausnutzen, um Sicherheitsvorkehrungen zu umgehen und so Daten offenzulegen oder zu manipulieren.
- GHSA-5hx7-j24v-rffjGeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool2026-09-09ghsa · osvUS
### Summary An unauthenticated server-side request forgery vulnerability lets any anonymous user make the GeoNetwork server issue arbitrary outbound HTTP requests. This gives an external attacker a position inside the server's network, making it possible to make internal requests no matter if the response is XML-type or not. The SLD tooling endpoint `POST /api/tools/ogc/sld` takes a caller-supplied **WMS server URL** and performs a **server-side HTTP GET** to it, with no validation. The fetched body can also be stored and downloaded if the output of the outbound request is in XML format, making the SSRF non-blind. ### Impact Any unauthenticated user can make the server send arbitrary HTTP requests to internal hosts it would never expose publicly, and read the responses back if the request responses are XML. This enables internal data disclosure, for example, configuration files that return as XML, authorization bypass, and reconnaissance of the internal network all from an anonymous position. ### Resolution Patched releases: * 4.4.12 * 4.2.17 ### Resources * https://github.com/geonetwork/core-geonetwork/pull/9343
sources
Which sources assert this record, and when.
references (7) nvd
External citations — patches, advisories, analysis.
- https://github.com/geonetwork/core-geonetwork/commit/17fdae28a5a51996bf5ff7f7e8236332c74eab77
- https://github.com/geonetwork/core-geonetwork/commit/a80d535c842e6af589d0bac37e7fe4ba01193757
- https://github.com/geonetwork/core-geonetwork/pull/9343
- https://github.com/geonetwork/core-geonetwork/pull/9344
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.17
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.12
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan