CVE-2026-39922
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An SSRF vulnerability in GeoNode versions 4.4.5 and 5.0.2 (and prior) allows authenticated attackers to send outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Insufficient IP filtering in the WMS service handler enables probing of internal network resources, including loopback addresses, RFC1918 private ranges, link-local addresses, and cloud metadata services.
Risk Assessment
The risk involves potential SSRF attacks that could lead to exposure of sensitive internal network data, bypass of perimeter security controls, and potential compromise of cloud services through access to their metadata endpoints.
Recommendation
Immediately upgrade GeoNode to version 4.4.6 or 5.0.3 (or later) which contain the fix. Additionally, implement IP filtering at the network firewall level and restrict access to the service registration endpoint to trusted users only.
Original NVD description (English source)
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.