Vulnerability record/PUBLISHED/Published Apr 10, 2026 19:53:05 UTC

CVE-2026-39922

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

Base score5.3/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredLowPR

User interactionNoneUI

Vulnerable system confidentialityLowVC

Vulnerable system integrityLowVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityLowSC

Subsequent system integrityLowSI

Subsequent system availabilityLowSA

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck

Last updatedNov 8, 2026 14:02:35 UTC

PublishedApr 10, 2026 19:53:05 UTC

ReservedApr 7, 2026 20:57:06 UTC

Credits

Elure (Marasescu Mihnea-Luca)