Geonode CVE-2026-39922

The CVSS v4.0 score of 5.3 reflects a medium-severity issue with network attack vector (AV:N), low attack complexity (AC:L), no special technical interaction (AT:N), but crucially a requirement for low-level privileges (PR:L), indicating authentication is mandatory. The impact scope shows limited confidentiality (VC:L), integrity (VI:L), and scope impacts (SC:L, SI:L). However, multiple risk signals suggest this warrants elevated attention: First, the requirement for authenticated access significantly reduces real-world exploitability compared to unauthenticated SSRF vulnerabilities, as attackers must already have valid credentials or compromise an existing account. Second, the vulnerability is specifically scoped to network reconnaissance of internal services and cloud metadata endpoints rather than arbitrary code execution or direct data exfiltration, limiting the immediate technical impact. Third, SSRF vulnerabilities targeting metadata services (AWS IMDSv1, GCP metadata APIs) represent a recognized attack chain for privilege escalation and credential theft in cloud-native deployments. The CVSS vector marks E:X (Exploitation maturity unknown) and includes multiple X values for optional metrics, suggesting incomplete data, but the deterministic attack vector (crafted URL submission to a known endpoint) implies high automation potential if cloud deployments are identified. The practical risk is highest in environments where GeoNode instances are exposed to threat actors who either have legitimate credentials or can obtain them, and where internal network segmentation is weak.

An authenticated user with access to GeoNode's service registration interface (a web form requiring valid credentials) submits a crafted WMS service URL pointing to an internal target such as http://127.0.0.1:8080/admin or a cloud metadata endpoint like http://169.254.169.254/latest/meta-data/iam/security-credentials/. During form validation, GeoNode's server makes an outbound HTTP request to the attacker-specified URL without filtering, allowing the attacker to read the HTTP response or infer service availability through timing and error messages. In cloud environments, this enables harvesting of temporary AWS credentials, GCP service account tokens, or Azure managed identity tokens, which can then be used for privilege escalation and lateral movement within the cloud account.