CVE-2026-39922
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An SSRF vulnerability in GeoNode versions 4.4.5 and 5.0.2 (and prior) allows authenticated attackers to send outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Insufficient IP filtering in the WMS service handler enables probing of internal network resources, including loopback addresses, RFC1918 private ranges, link-local addresses, and cloud metadata services.
Risk Assessment
The risk involves potential SSRF attacks that could lead to exposure of sensitive internal network data, bypass of perimeter security controls, and potential compromise of cloud services through access to their metadata endpoints.
Recommendation
Immediately upgrade GeoNode to version 4.4.6 or 5.0.3 (or later) which contain the fix. Additionally, implement IP filtering at the network firewall level and restrict access to the service registration endpoint to trusted users only.
Other vulnerabilities in GeoNode
See all- CVE-2026-39921Medium
An SSRF vulnerability in GeoNode allows authenticated users with document upload permissions to send arbitrary HTTP requests by providing a malicious URL in the doc_url parameter. Attackers can target internal network resources, loopback addresses, RFC1918 addresses, or cloud metadata services.
- CVE-2023-40017High
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery, allowing an attacker to port scan internal hosts and request information from them.
Original NVD description (English source)
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS