CVE-2026-42352

HighCVSS 8.6

Published: 08/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Pygeoapi versions 0.23.0 through 0.23.3 have a vulnerability that allows using the subscriber object to make requests to internal HTTP services during OGC API process execution. This issue is fixed in version 0.23.3.

Risk Assessment

Attackers can exploit this vulnerability for SSRF attacks, gaining access to internal network resources and potentially exfiltrating data.

Recommendation

Upgrade pygeoapi to version 0.23.3 or later.

Other vulnerabilities in pygeoapi

CVE-2026-42351High
pygeoapi versions 0.23.0 through 0.23.2 have a path concatenation vulnerability in the STAC FileSystemProvider plugin. Lack of URL normalization may allow unauthenticated access to directories when deployed without a proxy that normalizes '..' in URLs.

Original NVD description (English source)

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.