CVE-2026-39922 Overview
CVE-2026-39922 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in GeoNode, an open-source geospatial content management platform maintained by GeoSolutions Group. The flaw resides in the service registration endpoint, where the Web Map Service (WMS) handler fails to validate user-supplied URLs before issuing outbound HTTP requests. Authenticated attackers can submit crafted service URLs during form validation to coerce the application into contacting arbitrary internal hosts. Affected releases include GeoNode 4.4.5 and 5.0.2, along with prior versions in those branches.
Critical Impact
Authenticated attackers can pivot from GeoNode to internal infrastructure, probing loopback interfaces, RFC1918 private ranges, link-local addresses, and cloud metadata endpoints such as 169.254.169.254.
Affected Products
- GeoNode 4.4.5 and prior 4.x releases
- GeoNode 5.0.2 and prior 5.x releases
- Deployments exposing the service registration endpoint to authenticated users
Discovery Timeline
- 2026-04-10 - CVE-2026-39922 published to NVD
- 2026-04-16 - Last updated in NVD database
Technical Details for CVE-2026-39922
Vulnerability Analysis
GeoNode exposes a service registration workflow that accepts a remote URL pointing to an OGC-compliant endpoint such as WMS, WFS, or WCS. When a user submits the form, the backend performs server-side validation by issuing an HTTP request to confirm the service responds with expected metadata. The WMS service handler dispatches this request without filtering the destination host, enabling SSRF against any reachable network resource.
Because the request originates from the GeoNode server, attackers reach assets that are otherwise unreachable from the public internet. Targets include internal administrative panels, container orchestration APIs, databases bound to localhost, and cloud instance metadata services that issue temporary credentials. Response behavior, timing, and error messages can be leveraged to map internal infrastructure even when full response contents are not returned.
Root Cause
The handler trusts user-supplied URLs without enforcing an allowlist of permitted hosts or rejecting addresses in reserved ranges. There is no DNS resolution check to verify that hostnames do not resolve to private IPs, and no protocol restriction limiting requests to HTTP and HTTPS. The validation logic accepts the URL, resolves it, and connects to whatever target the resolver returns.
Attack Vector
An authenticated user with permission to register external services submits a crafted service URL referencing an internal target. Example targets include http://127.0.0.1:8080/admin, http://10.0.0.5:5432, or http://169.254.169.254/latest/meta-data/iam/security-credentials/. The GeoNode backend issues the outbound request and surfaces response data or differential errors back to the attacker through form validation feedback. See the GitHub Security Advisory and Vulncheck Advisory for GeoNode SSRF for additional technical context.
Detection Methods for CVE-2026-39922
Indicators of Compromise
- Outbound HTTP requests from GeoNode application servers to RFC1918 ranges, 127.0.0.0/8, or 169.254.0.0/16
- Application logs showing service registration attempts with URLs targeting internal hosts or cloud metadata endpoints
- Unexpected HTTP requests from the GeoNode service account to internal management interfaces
- Authentication events for low-privilege GeoNode users followed by service registration form submissions
Detection Strategies
- Inspect GeoNode application logs for service registration submissions and correlate the url parameter against private IP ranges and metadata endpoints
- Monitor egress traffic from GeoNode hosts at the network layer and alert on connections to internal subnets that fall outside normal operational baselines
- Review web access logs for repeated POST requests to the service registration endpoint from a single user account
Monitoring Recommendations
- Enable verbose logging on the WMS service handler to capture full URLs submitted during registration
- Forward GeoNode application logs and host network flow data to a centralized analytics platform for correlation
- Establish baseline egress patterns and alert on deviations such as requests to 169.254.169.254 or non-routable address space
How to Mitigate CVE-2026-39922
Immediate Actions Required
- Upgrade GeoNode to a release that includes the SSRF fix from the GitHub Security Advisory
- Restrict service registration permissions to trusted administrative accounts only
- Apply egress filtering on GeoNode application servers to block requests to internal ranges and cloud metadata IPs
- Audit existing registered services for entries pointing at internal infrastructure
Patch Information
GeoNode maintainers have published a security advisory tracked as GHSA-hw9r-6m78-w6h3. Operators running GeoNode 4.4.5, 5.0.2, or earlier should upgrade to the fixed release identified in the advisory. The patch introduces URL validation that rejects private, loopback, and link-local destinations during service registration.
Workarounds
- Place GeoNode behind an egress proxy that enforces an allowlist of permitted external OGC service hosts
- Bind sensitive services such as databases, orchestration APIs, and admin panels to interfaces unreachable from the GeoNode host
- Use Instance Metadata Service Version 2 (IMDSv2) on AWS workloads to require session tokens for metadata access
- Temporarily disable the service registration feature if patching cannot be performed immediately
# Example egress firewall rules blocking SSRF targets from the GeoNode host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
