Executive brief
pygeoapi is a Python-based server used to publish geospatial data and processes via international standards. A security flaw allows unauthenticated users to trick the server into making requests to internal systems that are normally protected from the public internet. This could allow an attacker to access sensitive internal data or probe private corporate infrastructure, potentially leading to a breach of confidential information.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in pygeoapi's implementation of OGC API - Processes. The vulnerability is located in the handling of the 'subscriber' object within process execution requests, where the application fails to validate or restrict the destination of HTTP requests. An unauthenticated remote attacker can provide a URL pointing to internal loopback addresses or link-local ranges, causing the server to perform unauthorized requests to internal services. This can result in the exposure of sensitive internal data (Confidentiality: High). The issue is addressed in version 0.23.3 by disabling internal HTTP requests by default and introducing a new 'allow_internal_requests' configuration directive.
Affected products
- geopython pygeoapi >= 0.23.0, < 0.23.3
Timeline
- 2026-04-22: advisory: GitHub Security Advisory GHSA-jgvc-94c8-3chc published
- 2026-04-22: patched: Version 0.23.3 released
- 2026-05-08: disclosed: CVE-2026-42352 published