Is there a public PoC exploit available for EUVD-2026-21581?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21581. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for EUVD-2026-21581?

Yes, a patch is available for EUVD-2026-21581. Update the affected software to the latest version immediately.

Geonode EUVD-2026-21581

Q: What is the CVSS score of EUVD-2026-21581?

EUVD-2026-21581 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-39922 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-10 VulnCheck

GHSA-hw9r-6m78-w6h3

GHSA-v8f7-cg9p-w5jx PYSEC-2026-61

SSRF Geonode

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21581

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

Patch released

Apr 10, 2026 - 20:15 nvd

Patch available

CVE Published

Apr 10, 2026 - 19:53 nvd

MEDIUM 5.3

DescriptionCVE.org

GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.

AnalysisAI

GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to probe internal networks, including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by submitting a crafted WMS service URL during form validation. The vulnerability exploits insufficient URL validation without private IP filtering or allowlist enforcement. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS v4.0 score of 5.3 reflects a medium-severity issue with network attack vector (AV:N), low attack complexity (AC:L), no special technical interaction (AT:N), but crucially a requirement for low-level privileges (PR:L), indicating authentication is mandatory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated user with access to GeoNode's service registration interface (a web form requiring valid credentials) submits a crafted WMS service URL pointing to an internal target such as http://127.0.0.1:8080/admin or a cloud metadata endpoint like http://169.254.169.254/latest/meta-data/iam/security-credentials/. During form validation, GeoNode's server makes an outbound HTTP request to the attacker-specified URL without filtering, allowing the attacker to read the HTTP response or infer service availability through timing and error messages. …
Remediation	Vendor-released patches are available: upgrade to GeoNode 4.4.5 or later for the 4.x branch, or upgrade to GeoNode 5.0.2 or later for the 5.x branch. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

EUVD-2026-21581 vulnerability details – vuln.today

Back