Is CVE-2026-53573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53573 being exploited in the wild.

How severe is CVE-2026-53573?

Medium severity, with a CVSS score of 3.1, published 31 July 2026.

Which products and versions are affected?

GeoNetwork-opensource GeoNetwork 3.12.0 to 4.2.15, 4.4.0 to 4.4.10; org.geonetwork-opensource:geonetwork (Maven) ECOSYSTEM:introduced=3.12.0,last_affected=3.12.12.

Is there a fix for CVE-2026-53573?

A patch was published on 2026-06-01: Fixes merged into main and 4.2.x branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53573 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53573?

Check whether you run GeoNetwork-opensource GeoNetwork or org.geonetwork-opensource:geonetwork (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53573: GeoNetwork open redirect in OAuth2 and Keycloak login filters

CVE-2026-53573 · Severity: medium · CVSS 3.1 · Published 2026-07-31

GeoNetwork, an application used to manage geographic data and maps, contains a security flaw in its login process. An attacker can trick users into visiting a malicious website by redirecting them to an external link immediately after they log in. This can be used in phishing campaigns to steal user credentials or distribute malware by making the malicious site appear to be part of the trusted GeoNetwork portal.

Technologies: GeoNetwork-opensource GeoNetwork, org.geonetwork-opensource:geonetwork (Maven). Vendors: GeoNetwork-opensource, Maven.

Quick answers

Is CVE-2026-53573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53573 being exploited in the wild.
How severe is CVE-2026-53573?: Medium severity, with a CVSS score of 3.1, published 31 July 2026.
Which products and versions are affected?: GeoNetwork-opensource GeoNetwork 3.12.0 to 4.2.15, 4.4.0 to 4.4.10; org.geonetwork-opensource:geonetwork (Maven) ECOSYSTEM:introduced=3.12.0,last_affected=3.12.12.
Is there a fix for CVE-2026-53573?: A patch was published on 2026-06-01: Fixes merged into main and 4.2.x branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53573 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53573?: Check whether you run GeoNetwork-opensource GeoNetwork or org.geonetwork-opensource:geonetwork (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in GeoNetwork's GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter. The application fails to properly validate the 'redirectUrl' parameter during the authentication flow, allowing it to point to external domains. An attacker can craft a link that, upon successful authentication by a user, redirects the victim to an attacker-controlled site. The fix involves centralizing validation in a RedirectUtil helper that restricts redirects to server-local relative paths. Patches are available in versions 4.2.16 and 4.4.11.

Affected products

GeoNetwork GeoNetwork 3.12.0 to 4.2.15, 4.4.0 to 4.4.10

Identifiers

CVE-2026-53573
GHSA-pjp7-q6wp-97qx

Timeline

2026-06-01: patched: Fixes merged into main and 4.2.x branches
2026-07-31: disclosed: CVE-2026-53573 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.