What is the CVSS score of CVE-2026-76904?

CVE-2026-76904 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-76904?

Yes, a public proof-of-concept exploit is available for CVE-2026-76904. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-76904?

Within 24 hours, identify all systems running GeoTools versions 30.5 through 33.5, 34.4, or 35.0 that use PostGIS, and prioritize by whether they are internet-facing or process sensitive location data. Within 7 days, upgrade all affected installations to GeoTools 33.6, 34.5, or 35.1 (matching your current release line), testing the upgrade in a staging environment before rolling out to production. Within 30 days, audit database access logs for anomalous SQL activity during the vulnerability window, strengthen database access controls if needed, and complete post-remediation validation that only authorized applications can query the database.

GeoTools CVE-2026-76904

EUVD-2026-64133 CRITICAL

SQL Injection (CWE-89)

2026-08-21 GitHub_M

GHSA-mqjf-5f49-2fjh

Java SQLi Geotools

9.8

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach public OGC filter endpoint
Delivery

Craft jsonArrayContains value with quote breakout
Exploit

Inject SQL via unescaped JSONPath literal
Execution

Execute arbitrary SQL on PostGIS
Impact

Exfiltrate or modify database data

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an application that exposes GeoTools OGC/CQL filter evaluation to attacker-controlled input against a PostGIS DataStore, the jsonArrayContains function being usable in that filter, a PostGIS backend at version 12 or greater, and the target column being a String or JSON/jsonb field. Limiting factors: exploitation is impossible if filters are not user-reachable, if no String/JSON column is queried, or if PostGIS is below 12; impact is constrained by the privileges granted to the PostGIS connection-pool role. Authentication is not required per the CVSS vector (PR:N), so where filters are publicly reachable this is unauthenticated.
Impact	The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), and EPSS was not provided. The score is credible for internet-exposed applications that let users submit OGC/CQL filters against a PostGIS store (e.g., GeoServer WFS/WMS/WPS endpoints), but the raw 9.8 overstates universal risk because real exploitation is gated on environmental preconditions: PostGIS 12+, a String or JSON field, and the jsonArrayContains function being reachable from attacker-controllable filters. Where those conditions hold, an unauthenticated attacker can inject arbitrary SQL, so any organization running a public GeoServer-style deployment should treat this as urgent; where filters are not user-exposed or no JSON column exists, practical risk is much lower. No KEV listing and no identified public exploit mean this is not confirmed to be under active exploitation, but the public patch and tests lower the bar to weaponization, so patch promptly rather than deferring.
Exploit ScenarioDerived	An attacker submits a crafted OGC/CQL filter to a public GeoServer-style endpoint that queries a PostGIS layer with a JSON column, calling jsonArrayContains(col, pointer, value) with a value containing an embedded quote to break out of the JSONPath literal and append arbitrary SQL. Because no authentication is required (PR:N) and complexity is low (AC:L), the injected SQL executes with the connection pool's database privileges, enabling data theft or modification. No public exploit is identified, but the upstream fix and regression tests reveal the exact quote-breakout technique.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

2 public PoCs Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 21, 2026

SQL injection in the GeoTools Java geospatial library (gt-jdbc-postgis module) lets remote unauthenticated attackers execute arbitrary SQL against PostGIS-backed layers via the OGC Filter jsonArrayContains function. Affected builds run from 30.5 up to the fixed 33.6, 34.5, and 35.1 releases, where the function's value argument is written into generated SQL without escaping. No active exploitation is listed in CISA KEV and no public exploit is identified, though the upstream fix commit and regression tests publicly demonstrate the injection payload structure.

RemediationAI

Vendor-released patch: upgrade gt-jdbc-postgis to 33.6, 34.5, or 35.1 depending on your branch (release tags: https://github.com/geotools/geotools/releases/tag/33.6, /34.5, /35.1; fix in PR https://github.com/geotools/geotools/pull/5829 and commit d821c4d321dd91c22e31fcd5b1ce676645da5176). The advisory states no true workaround exists; as a compensating control, configure the PostGIS connection pool to use a database role with least privilege (read-only, restricted to required tables, no DDL/superuser) to limit the blast radius of any injected SQL - this reduces impact but does not prevent data exfiltration from readable tables and may break write-dependent features. Additionally, restrict or authenticate access to filter-accepting endpoints (e.g., WFS/CQL) and avoid exposing jsonArrayContains-capable layers to untrusted users until patched. Track vendor issues GEOT-7958, GEOT-7959, and GEOT-7589.

Affected VersionsENISA

geotools 30.5, < 33.6

geotools 34.0, < 34.5

geotools = 35.0

Affected Packages

maven org.geotools.jdbc:gt-jdbc-postgis fix: 33.6, 34.5, 35.1

euvd geotools fix: 33.6, 34.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

GeoTools underpins many Java geospatial stacks (notably GeoServer) and translates OGC/CQL filter expressions into backend SQL through FilterToSqlHelper. The flaw is a classic CWE-89 SQL injection: for PostGIS 12+, jsonArrayContains(<column>, <pointer>, <value>) builds a jsonb_path_exists() predicate and interpolates the caller-supplied <value> directly into the JSONPath string literal ('$ ? (@.field == "<value>")') without escaping quotes. The fix (PR #5829, commit d821c4d) introduces escapeJsonLiteral() to neutralize embedded quotes, as shown by the added tests asserting doubled/backslash-escaped quotes. Exploitation requires a String or JSON/jsonb column and PostGIS 12 or greater. Affected CPE: cpe:2.3:a:geotools:geotools.

Know when Geotools gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated remote SQL injection via user-supplied OGC filters (AV:N/PR:N/UI:N); AC:L as no evasion is needed once the JSON column feature is reachable; full SQL access yields C/I/A High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 21, 2026 - 21:02 EUVD

CVE Published

Aug 21, 2026 - 20:13 cve.org

CRITICAL 9.8

DescriptionCVE.org

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Articles & Coverage 1

News Critical SQL Injection in GeoTools Java gt-jdbc-postgis - CVE-2026-76904 Aug 21, 2026

Latest POC

2 public PoC links from github, nuclei

Executive ViewAI

Why It Matters

A critical SQL injection vulnerability in GeoTools (CVSS 9.8) exposes organizations' geospatial databases to unauthenticated remote attackers who can read, modify, or delete data with no authentication requirement. Organizations running affected GeoTools versions risk data breaches affecting applications that depend on location data, customer information, or operational intelligence stored in their PostGIS databases. Patched versions are available and deployment should begin immediately.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Model

5 threats: Information Disclosure, Tampering, Denial of Service and 2 more

5-step attack chain with trust boundaries and controls

Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.

Threat Intelligence Overview

EPSS Score

0.4%

Top 64% exploitable

Prevalence

Medium

widely used GIS library behind GeoServer, but not universally deployed

Threat Intel

1 sources

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA POC (1)

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.