CVE-2026-39922

Description

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

PUBLISHED Reserved 2026-04-07 | Published 2026-04-10 | Updated 2026-05-08 | Assigner VulnCheck

Problem types

Server-Side Request Forgery (SSRF)

Product status

Credits

Elure (Marasescu Mihnea-Luca) finder

References

github.com/...eonode/security/advisories/GHSA-hw9r-6m78-w6h3 vendor-advisory

www.vulncheck.com/...s/geonode-ssrf-via-service-registration third-party-advisory

cve.org (CVE-2026-39922)

nvd.nist.gov (CVE-2026-39922)

Download JSON