Executive brief
GeoNetwork is a web-based geospatial data management platform used by organizations to share and manage geographic information. An unauthenticated attacker can exploit a flaw in the SLD (Styled Layer Descriptor) tool endpoint to make the server issue arbitrary HTTP requests to internal systems that should not be publicly accessible, potentially disclosing sensitive configuration files, enabling network reconnaissance, and bypassing authorization controls.
Technical details
The vulnerability is a classic Server-Side Request Forgery (SSRF, CWE-918) in the SLD tooling endpoint POST /api/tools/ogc/sld. The endpoint accepts a caller-supplied WMS server URL and performs an unauthenticated, unvalidated server-side HTTP GET request to that URL. No input validation or allowlist filtering is applied to the URL parameter. An attacker can supply arbitrary URLs pointing to internal systems, causing the GeoNetwork server to issue requests on their behalf. If the HTTP response body is in XML format, the response is not only fetched but can also be stored and downloaded by the attacker, converting this into a non-blind SSRF. This enables attackers to read internal configuration files, enumerate internal services, perform authorization bypass, and conduct network reconnaissance—all from an unauthenticated position with only network access. Patched versions 4.4.12 and 4.2.17 are available.
Affected products
- GeoNetwork GeoNetwork >=4.4.0, <=4.4.11 and >=4.0.0, <=4.2.16
Timeline
- 2026-08-31: disclosed: Published to GitHub Advisory Database on August 31, 2026
- 2026-09-09: patched: Patched releases 4.4.12 and 4.2.17 available