CVE-2026-55864: GeoNetwork unauthenticated server-side request forgery in SLD tool

CVE-2026-55864 · Severity: high · CVSS 4 · Published 2026-09-15

GeoNetwork is a web-based geospatial data management platform used by organizations to share and manage geographic information. An unauthenticated attacker can exploit a flaw in the SLD (Styled Layer Descriptor) tool endpoint to make the server issue arbitrary HTTP requests to internal systems that should not be publicly accessible, potentially disclosing sensitive configuration files, enabling network reconnaissance, and bypassing authorization controls.

Vendors: Maven.

Quick answers

Is CVE-2026-55864 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55864 being exploited in the wild.
How severe is CVE-2026-55864?
High severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
org.geonetwork-opensource:gn-web-app (Maven) ECOSYSTEM:introduced=4.4.0,fixed=4.4.12.
Is there a fix for CVE-2026-55864?
Yes. org.geonetwork-opensource:gn-web-app (Maven): upgrade to 4.4.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55864 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55864?
Check whether you run org.geonetwork-opensource:gn-web-app (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.geonetwork-opensource:gn-web-app (Maven): upgrade to 4.4.12 or later
    # set org.geonetwork-opensource:gn-web-app to 4.4.12 in your pom.xml or build.gradle

Technical details

The vulnerability is a classic Server-Side Request Forgery (SSRF, CWE-918) in the SLD tooling endpoint POST /api/tools/ogc/sld. The endpoint accepts a caller-supplied WMS server URL and performs an unauthenticated, unvalidated server-side HTTP GET request to that URL. No input validation or allowlist filtering is applied to the URL parameter. An attacker can supply arbitrary URLs pointing to internal systems, causing the GeoNetwork server to issue requests on their behalf. If the HTTP response body is in XML format, the response is not only fetched but can also be stored and downloaded by the attacker, converting this into a non-blind SSRF. This enables attackers to read internal configuration files, enumerate internal services, perform authorization bypass, and conduct network reconnaissance—all from an unauthenticated position with only network access. Patched versions 4.4.12 and 4.2.17 are available.

Affected products

  • GeoNetwork GeoNetwork >=4.4.0, <=4.4.11 and >=4.0.0, <=4.2.16

Identifiers

  • CVE-2026-55864
  • GHSA-5hx7-j24v-rffj

Timeline

  • 2026-08-31: disclosed: Published to GitHub Advisory Database on August 31, 2026
  • 2026-09-09: patched: Patched releases 4.4.12 and 4.2.17 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.