GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool

Published September 9, 2026 CVE-2026-55864

GeoNetwork can be tricked into making requests to private services behind its server. It can also return XML responses from those services to an anonymous visitor.

Severity
HighCVSS 4.0 · 7.7 · github.com
Fix
Fixed in 4.4.12, 4.2.17Fix recorded yesterday
Affected versions
4.4.0 or newer and 4.4.11 or older; 4.0.0 or newer and 4.2.16 or older
Weakness
CWE-918Server-Side Request Forgery (SSRF)
Affects
org.geonetwork-opensource:gn-web-app

How it works

  • An attacker sends a WMS server address to GeoNetwork's SLD tool without logging in.
  • GeoNetwork fetches that address without checking where it points.
  • If the response is XML, the attacker can download it through GeoNetwork.
  • The source specifically supports internal data disclosure and network reconnaissance.

What to do

Compare the deployed GeoNetwork Web Module version with the affected ranges in the GitHub advisory. Versions 4.4.0 through 4.4.11 and 4.0.0 through 4.2.16 are affected.

Upgrade to GeoNetwork Web Module 4.4.12 or 4.2.17, matching your release branch. Use the advisory for the documented release guidance.

Technical details

Affected software: org.geonetwork-opensource:gn-web-app

CVE-2026-55864 affects the Maven package org.geonetwork-opensource:gn-web-app. POST /api/tools/ogc/sld accepts a caller-supplied WMS URL and performs an unvalidated server-side HTTP GET. XML responses can be stored and downloaded, making the SSRF readable rather than blind. Patched releases are 4.4.12 and 4.2.17.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure High Sensitive data can be exposed with serious impact
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source