EUVD-2026-21579
GHSA-x87c-g7pw-2xr5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.3 indicates moderate risk with low immediate impact, but contextual factors elevate real-world concern. Attack vector is network (AV:N) with low complexity (AC:L) and requires low privilege (PR:L)-a common baseline for authenticated document upload roles. EPSS exploitation probability and KEV status are not provided, suggesting no confirmed active exploitation at time of publication. However, the attack surface is accessible to any authenticated user with document upload permissions, which may be broad in collaborative geospatial platforms. The lack of redirect validation is a known weakness amplified by SSRF; attackers can chain requests to bypass simplistic IP filters via open redirects. Real-world risk depends on deployment context: isolated research instances rate low; internet-facing platforms with loose access controls and cloud hosting rate moderate to high. The absence of POC and KEV status indicates this is not an immediately weaponized threat, but the technical simplicity (parameter injection into HTTP request) suggests rapid exploitation once tooling emerges. |
| Exploit ScenarioDerived | An authenticated user with document upload permissions crafts a malicious POST request to the document upload endpoint, setting the doc_url parameter to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata service). The GeoNode server, lacking SSRF validation, fetches the URL and exposes temporary AWS credentials in the response, which the attacker can intercept or log via error messages. Alternatively, an attacker supplies doc_url pointing to an internal service (http://10.0.1.50:8080/admin), causing the server to probe internal infrastructure and report availability or content via HTTP status codes and response body inspection. No public exploit code has been identified, reducing immediate risk. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Server-side request forgery in GeoNode 4.0-4.4.4 and 5.0-5.0.1 allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by supplying a malicious URL via the doc_url parameter, enabling attacks against internal network resources, loopback addresses, RFC1918 networks, and cloud metadata services without SSRF mitigations. CVSS 5.3 reflects low confidentiality and integrity impact but requires prior authentication; no public exploit code or active exploitation has been identified.
RemediationAI
Upgrade GeoNode to version 4.4.5 or later for the 4.x series, or version 5.0.2 or later for the 5.x series. Patch releases are available from the official GitHub repository (https://github.com/GeoNode/geonode/releases). Pending patch deployment, implement network-level controls by restricting outbound HTTP/HTTPS requests from the GeoNode application server to external destinations, and configure firewall rules to block requests to private IP ranges (RFC1918, loopback, link-local) and cloud metadata endpoints. Review document upload role assignments to minimize the number of authenticated users with upload privileges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in GeoNode's document upload handler, which processes the doc_url parameter without proper validation or filtering of destination IP ranges and redirect chains. GeoNode is a Django-based geospatial data management platform (CPE: cpe:2.3:a:geonode:geonode). The root cause is classified as CWE-918 (Server-Side Request Forgery), which allows the application server to be weaponized as a proxy for internal network reconnaissance and data exfiltration. The absence of controls such as private IP range blocking (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and validation of HTTP redirect targets creates a direct path to cloud metadata endpoints (AWS IMDSv2, GCP metadata service, Azure IMDS) and internal services.
Know when Geonode gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a malicious URL via the doc_url parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services to cause the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service regist
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
Exploit-DB