Executive brief
GeoNode, an open-source geospatial content management system, contains a security flaw in its service registration feature. An authenticated user can trick the server into making unauthorized network requests to internal systems or cloud metadata services. This could allow an attacker to map out private internal networks or access sensitive configuration data that is not intended to be public.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in GeoNode's service registration endpoint due to insufficient URL validation in the WMS service handler. Authenticated attackers can exploit this by submitting crafted service URLs during form validation, which the server then attempts to reach. Because the application lacks private IP filtering or allowlist enforcement, attackers can trigger outbound requests to loopback addresses, RFC1918 private ranges, and cloud metadata services. This vulnerability is patched in versions 4.4.5 and 5.0.2.
Affected products
- GeoNode GeoNode >= 4.0.0, < 4.4.5; >= 5.0.0, < 5.0.2
Timeline
- 2026-03-27: patched: Version 4.4.5 released
- 2026-03-31: patched: Version 5.0.2 released
- 2026-04-10: disclosed: Initial advisory publication
- 2026-06-08: other: Advisory withdrawn as a duplicate of GHSA-hw9r-6m78-w6h3