Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-55864GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

High 7.8

In plain English

A high-severity server-side request forgery in core-geonetwork from geonetwork. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.8High
Exploit odds (30 days)1.4%top 26.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei

Official description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.geonetwork-opensource:gn-web-app4.4.12GHSA-5hx7-j24v-rffj
Mavenorg.geonetwork-opensource:gn-web-app4.2.17GHSA-5hx7-j24v-rffj

Affected products (as reported)

VendorProductVersions
geonetwork core-geonetwork >= 4.0.0, < 4.2.17>= 4.4.0, < 4.4.12

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

References