EUVD-2026-21581
GHSA-hw9r-6m78-w6h3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
AnalysisAI
GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to probe internal networks, including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by submitting a crafted WMS service URL during form validation. The vulnerability exploits insufficient URL validation without private IP filtering or allowlist enforcement. No public exploit code has been identified at the time of analysis.
Technical ContextAI
The vulnerability exists in GeoNode's WMS service handler within the service registration endpoint (affected CPE: cpe:2.3:a:geonode:geonode:*:*:*:*:*:*:*:*). The root cause is classified as CWE-918 (Server-Side Request Forgery), which occurs when application logic makes HTTP requests to URLs derived from user input without proper validation. In this case, the service registration form accepts a service URL parameter that is validated by making an outbound request to that URL without filtering or blocking requests to private IP address ranges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), or cloud metadata service endpoints. This allows the form validation logic itself to become a network probing tool under the attacker's control.
RemediationAI
Vendor-released patches are available: upgrade to GeoNode 4.4.5 or later for the 4.x branch, or upgrade to GeoNode 5.0.2 or later for the 5.x branch. Both patched versions address the insufficient URL validation in the WMS service handler. Administrators unable to patch immediately should implement network-level controls restricting outbound connections from GeoNode application servers to internal IP ranges (RFC1918, 127.0.0.0/8, 169.254.0.0/16) and cloud metadata service endpoints (169.254.169.254 for AWS IMDSv1/v2, metadata.google.internal for GCP). Additionally, limit service registration functionality to trusted administrative users and disable the service registration feature entirely if not required for operations. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration for additional context and vendor communication.
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
Server-side request forgery in GeoNode 4.0-4.4.4 and 5.0-5.0.1 allows authenticated users with document upload permissio
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Rat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today