CVE-2026-39921
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An SSRF vulnerability in GeoNode allows authenticated users with document upload permissions to send arbitrary HTTP requests by providing a malicious URL in the doc_url parameter. Attackers can target internal network resources, loopback addresses, RFC1918 addresses, or cloud metadata services.
Risk Assessment
The risk includes internal network scanning, access to sensitive internal services (e.g., cloud metadata), and potential escalation of attacks against other systems within the organization.
Recommendation
Immediately upgrade GeoNode to version 4.4.5 or later (for 4.x branch) and 5.0.2 or later (for 5.x branch). In the interim, restrict document upload permissions and implement IP address filtering at the network firewall level.
Other vulnerabilities in GeoNode
See all- CVE-2026-39922Medium
An SSRF vulnerability in GeoNode versions 4.4.5 and 5.0.2 (and prior) allows authenticated attackers to send outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Insufficient IP filtering in the WMS service handler enables probing of internal network resources, including loopback addresses, RFC1918 private ranges, link-local addresses, and cloud metadata services.
- CVE-2023-40017High
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery, allowing an attacker to port scan internal hosts and request information from them.
Original NVD description (English source)
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS