CVE-2026-39922: GeoNode SSRF Vulnerability

CVE-2026-39922 Overview

CVE-2026-39922 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in GeoNode, an open-source geospatial content management platform maintained by GeoSolutions Group. The flaw resides in the service registration endpoint, where the Web Map Service (WMS) handler fails to validate user-supplied URLs before issuing outbound HTTP requests. Authenticated attackers can submit crafted service URLs during form validation to coerce the application into contacting arbitrary internal hosts. Affected releases include GeoNode 4.4.5 and 5.0.2, along with prior versions in those branches.

Critical Impact
Authenticated attackers can pivot from GeoNode to internal infrastructure, probing loopback interfaces, RFC1918 private ranges, link-local addresses, and cloud metadata endpoints such as 169.254.169.254.

Affected Products

GeoNode 4.4.5 and prior 4.x releases
GeoNode 5.0.2 and prior 5.x releases
Deployments exposing the service registration endpoint to authenticated users

Discovery Timeline

2026-04-10 - CVE-2026-39922 published to NVD
2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-39922

Vulnerability Analysis

GeoNode exposes a service registration workflow that accepts a remote URL pointing to an OGC-compliant endpoint such as WMS, WFS, or WCS. When a user submits the form, the backend performs server-side validation by issuing an HTTP request to confirm the service responds with expected metadata. The WMS service handler dispatches this request without filtering the destination host, enabling SSRF against any reachable network resource.

Because the request originates from the GeoNode server, attackers reach assets that are otherwise unreachable from the public internet. Targets include internal administrative panels, container orchestration APIs, databases bound to localhost, and cloud instance metadata services that issue temporary credentials. Response behavior, timing, and error messages can be leveraged to map internal infrastructure even when full response contents are not returned.

Root Cause

The handler trusts user-supplied URLs without enforcing an allowlist of permitted hosts or rejecting addresses in reserved ranges. There is no DNS resolution check to verify that hostnames do not resolve to private IPs, and no protocol restriction limiting requests to HTTP and HTTPS. The validation logic accepts the URL, resolves it, and connects to whatever target the resolver returns.

Attack Vector

An authenticated user with permission to register external services submits a crafted service URL referencing an internal target. Example targets include http://127.0.0.1:8080/admin, http://10.0.0.5:5432, or http://169.254.169.254/latest/meta-data/iam/security-credentials/. The GeoNode backend issues the outbound request and surfaces response data or differential errors back to the attacker through form validation feedback. See the GitHub Security Advisory and Vulncheck Advisory for GeoNode SSRF for additional technical context.

Detection Methods for CVE-2026-39922

Indicators of Compromise

Outbound HTTP requests from GeoNode application servers to RFC1918 ranges, 127.0.0.0/8, or 169.254.0.0/16
Application logs showing service registration attempts with URLs targeting internal hosts or cloud metadata endpoints
Unexpected HTTP requests from the GeoNode service account to internal management interfaces
Authentication events for low-privilege GeoNode users followed by service registration form submissions

Detection Strategies

Inspect GeoNode application logs for service registration submissions and correlate the url parameter against private IP ranges and metadata endpoints
Monitor egress traffic from GeoNode hosts at the network layer and alert on connections to internal subnets that fall outside normal operational baselines
Review web access logs for repeated POST requests to the service registration endpoint from a single user account

Monitoring Recommendations

Enable verbose logging on the WMS service handler to capture full URLs submitted during registration
Forward GeoNode application logs and host network flow data to a centralized analytics platform for correlation
Establish baseline egress patterns and alert on deviations such as requests to 169.254.169.254 or non-routable address space

How to Mitigate CVE-2026-39922

Immediate Actions Required

Upgrade GeoNode to a release that includes the SSRF fix from the GitHub Security Advisory
Restrict service registration permissions to trusted administrative accounts only
Apply egress filtering on GeoNode application servers to block requests to internal ranges and cloud metadata IPs
Audit existing registered services for entries pointing at internal infrastructure

Patch Information

GeoNode maintainers have published a security advisory tracked as GHSA-hw9r-6m78-w6h3. Operators running GeoNode 4.4.5, 5.0.2, or earlier should upgrade to the fixed release identified in the advisory. The patch introduces URL validation that rejects private, loopback, and link-local destinations during service registration.

Workarounds

Place GeoNode behind an egress proxy that enforces an allowlist of permitted external OGC service hosts
Bind sensitive services such as databases, orchestration APIs, and admin panels to interfaces unreachable from the GeoNode host
Use Instance Metadata Service Version 2 (IMDSv2) on AWS workloads to require session tokens for metadata access
Temporarily disable the service registration feature if patching cannot be performed immediately

bash

# Example egress firewall rules blocking SSRF targets from the GeoNode host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT