Read the docs
TI-2026-40323 Aliases CVE-2026-55864GHSA-5hx7-j24v-rffj

GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

Priority MEDIUM 43CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01446 73rd percentileScored 2026-11-07
Fix Fixed core-geonetwork (geonetwork): 4.2.17, 4.4.12org.geonetwork-opensource:gn-web-app (Maven): 4.4.12, 4.2.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geonetworkcore-geonetwork4.0.0 to before 4.2.17; 4.4.0 to before 4.4.124.2.17, 4.4.12Patch availableCNA
—org.geonetwork-opensource:gn-web-app (Maven)4.4.0 to before 4.4.124.4.12Patch availableGHSA-5hx7-j24v-rffj
—org.geonetwork-opensource:gn-web-app (Maven)4.0.0 to before 4.2.174.2.17Patch availableGHSA-5hx7-j24v-rffj
  • core-geonetwork Vendorgeonetwork Affected 4.0.0 to before 4.2.17; 4.4.0 to before 4.4.12 Fixed in 4.2.17, 4.4.12 Patch available CNA
  • org.geonetwork-opensource:gn-web-app (Maven) Vendor— Affected 4.4.0 to before 4.4.12 Fixed in 4.4.12 Patch available GHSA-5hx7-j24v-rffj
  • org.geonetwork-opensource:gn-web-app (Maven) Vendor— Affected 4.0.0 to before 4.2.17 Fixed in 4.2.17 Patch available GHSA-5hx7-j24v-rffj

Remediation

  • Fix · CNA core-geonetwork (geonetwork) Fixed in 4.2.17, 4.4.12
  • Fix · GHSA-5hx7-j24v-rffj org.geonetwork-opensource:gn-web-app (Maven) Fixed in 4.4.12 Advisory →
  • Fix · GHSA-5hx7-j24v-rffj org.geonetwork-opensource:gn-web-app (Maven) Fixed in 4.2.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55864
  2. 2026-10-03 Alias added: GHSA-5hx7-j24v-rffj
  3. 2026-10-29 EPSS moved to the 50th–90th percentile

References

Other 8

  • TI-2026-45097 Unauthenticated file upload via missing authorization on formatter upload endpoint CVSS 3.1HIGH 8.6
  • TI-2026-42016 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter CVSS 3.1CRITICAL 9.1
  • TI-2022-26353 Geonetwork 4.2.0 - XML External Entity (XXE) CVSS 4.0HIGH 8.7
  • TI-2026-84467 Access control bypass in GeoNetwork Elasticsearch search proxy CVSS 3.1HIGH 7.5
  • TI-2006-05324 SQL injection vulnerability in GeoNetwork opensource before 2.0.3 allows remote attackers… CVSS 2.0HIGH 7.5
  • TI-2026-84477 Reflected XSS in GeoNetwork through AngularJS template injection CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences