core-geonetwork has an Open Redirect Bypass
Priority LOW 23CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00648 51st percentileScored 2026-11-07
Fix Fixed core-geonetwork (geonetwork): 4.2.16, 4.4.11org.geonetwork-opensource:geonetwork (Maven): 4.2.16, 4.4.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geonetwork | core-geonetwork | 3.12.0 – 3.12.12; 4.0.0-alpha.1 – 4.0.6; 4.2.0 to before 4.2.16; 4.4.0 to before 4.4.11 | 4.2.16, 4.4.11 | Patch available | CNA |
| — | org.geonetwork-opensource:geonetwork (Maven) | 3.12.0 – 3.12.12 | — | No fix listed | GHSA-pjp7-q6wp-97qx |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.0.0-alpha.1 – 4.0.6 | — | No fix listed | GHSA-pjp7-q6wp-97qx |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.2.0 to before 4.2.16 | 4.2.16 | Patch available | GHSA-pjp7-q6wp-97qx |
| — | org.geonetwork-opensource:geonetwork (Maven) | 4.4.0 to before 4.4.11 | 4.4.11 | Patch available | GHSA-pjp7-q6wp-97qx |
- core-geonetwork Vendorgeonetwork Affected 3.12.0 – 3.12.12; 4.0.0-alpha.1 – 4.0.6; 4.2.0 to before 4.2.16; 4.4.0 to before 4.4.11 Fixed in 4.2.16, 4.4.11 Patch available CNA
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 3.12.0 – 3.12.12 Fixed in — No fix listed GHSA-pjp7-q6wp-97qx
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.0.0-alpha.1 – 4.0.6 Fixed in — No fix listed GHSA-pjp7-q6wp-97qx
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.2.0 to before 4.2.16 Fixed in 4.2.16 Patch available GHSA-pjp7-q6wp-97qx
- org.geonetwork-opensource:geonetwork (Maven) Vendor— Affected 4.4.0 to before 4.4.11 Fixed in 4.4.11 Patch available GHSA-pjp7-q6wp-97qx
Remediation
- Fix · CNA core-geonetwork (geonetwork) Fixed in 4.2.16, 4.4.11
- Fix · GHSA-pjp7-q6wp-97qx org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.2.16 Advisory →
- Fix · GHSA-pjp7-q6wp-97qx org.geonetwork-opensource:geonetwork (Maven) Fixed in 4.4.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53573
- 2026-10-03 Alias added: GHSA-pjp7-q6wp-97qx
- 2026-10-18 EPSS moved to the 50th–90th percentile
References
Other 8
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-pjp7-q6wp-97qx
- https://github.com/geonetwork/core-geonetwork/pull/9307
- https://github.com/geonetwork/core-geonetwork/pull/9309
- https://github.com/geonetwork/core-geonetwork/commit/0d74f673dfc926bde935819ed34636d789b2fecd
- https://github.com/geonetwork/core-geonetwork/commit/cde9b6481a29e2473b7b74479b4e3fd6843bac4e
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11
- https://github.com/geonetwork/core-geonetwork
More geonetwork vulnerabilities
- TI-2026-45097 Unauthenticated file upload via missing authorization on formatter upload endpoint CVSS 3.1HIGH 8.6
- TI-2026-42016 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter CVSS 3.1CRITICAL 9.1
- TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
- TI-2026-40323 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool CVSS 4.0HIGH 7.8
- TI-2026-84467 Access control bypass in GeoNetwork Elasticsearch search proxy CVSS 3.1HIGH 7.5
- TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
Sources
- CVE-2026-53573 · CVE Program
- CVE-2026-53573 · NVD
- FIRST EPSS
- GHSA-pjp7-q6wp-97qx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences