CVE-2026-39922: GeoNode SSRF Vulnerability

CVE-2026-39922 Overview

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a Server-Side Request Forgery (SSRF) vulnerability in the service registration endpoint. This flaw allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. The vulnerability stems from insufficient URL validation in the WMS service handler, which lacks private IP filtering or allowlist enforcement.

Critical Impact

Attackers can probe internal network infrastructure including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services, potentially exposing sensitive internal resources and enabling lateral movement within protected networks.

Affected Products

• GeoNode version 4.4.5 and prior versions in the 4.x release branch
• GeoNode version 5.0.2 and prior versions in the 5.x release branch
• Geosolutionsgroup GeoNode deployments with WMS service registration enabled

Discovery Timeline

• 2026-04-10 - CVE-2026-39922 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-39922

Vulnerability Analysis

This SSRF vulnerability (CWE-918) resides in GeoNode's service registration functionality, specifically within the WMS service handler. When users submit a service URL for registration, the application performs server-side validation that includes making outbound HTTP requests to the provided URL. The validation logic fails to implement proper restrictions on the target URL, allowing attackers to specify internal network addresses that would normally be inaccessible from outside the network perimeter.

The attack requires authentication to the GeoNode platform, meaning the attacker must have valid credentials. However, once authenticated, even users with minimal privileges can exploit this vulnerability to enumerate internal services, access cloud provider metadata endpoints (such as 169.254.169.254 for AWS/Azure/GCP), and potentially retrieve sensitive configuration data including instance credentials and API keys.

Root Cause

The root cause of this vulnerability is improper input validation in the WMS service registration endpoint. The application accepts user-controlled URLs and makes server-side requests without implementing:

• Private IP address filtering (RFC1918 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Loopback address blocking (127.0.0.0/8)
• Link-local address restrictions (169.254.0.0/16)
• URL scheme validation (allowing non-HTTP protocols)
• Allowlist enforcement for permitted external domains

Attack Vector

The attack is conducted over the network and requires low privileges (authenticated user access). An attacker submits a malicious service URL through the GeoNode service registration form. The server processes this URL by making an outbound request, effectively using the GeoNode server as a proxy to reach internal resources.

Typical attack scenarios include:

• Accessing cloud metadata services to retrieve instance credentials
• Scanning internal network ports and services
• Retrieving sensitive configuration files from internal web servers
• Bypassing firewall rules by leveraging the trusted GeoNode server position

For detailed technical information about exploitation techniques, refer to the GitHub Security Advisory and the VulnCheck Advisory.

Detection Methods for CVE-2026-39922

Indicators of Compromise

• Unusual outbound HTTP requests from the GeoNode server to internal IP ranges (RFC1918)
• HTTP requests targeting cloud metadata endpoints (169.254.169.254)
• Service registration attempts with non-standard URLs containing internal hostnames or IP addresses
• Elevated error rates in service registration logs indicating failed internal connection attempts
• Requests to loopback addresses (127.0.0.1) from the service registration handler

Detection Strategies

• Monitor GeoNode application logs for service registration events with suspicious URL patterns
• Implement network-level monitoring to detect outbound connections from the GeoNode server to internal IP ranges
• Configure web application firewall (WAF) rules to flag requests containing RFC1918 addresses or cloud metadata endpoints
• Deploy network segmentation monitoring to identify unexpected cross-zone traffic originating from the GeoNode server

Monitoring Recommendations

• Enable verbose logging on the GeoNode service registration endpoint to capture all submitted URLs
• Implement alerting for any outbound connections from the GeoNode server to the cloud metadata service IP (169.254.169.254)
• Review authentication logs to correlate suspicious service registration activity with specific user accounts
• Deploy SentinelOne Singularity to monitor for anomalous network behavior and SSRF exploitation patterns

How to Mitigate CVE-2026-39922

Immediate Actions Required

• Upgrade GeoNode to a patched version that addresses this vulnerability
• Implement network-level controls to prevent the GeoNode server from accessing internal network ranges
• Review service registration logs for evidence of past exploitation attempts
• Consider temporarily disabling the WMS service registration feature until patches are applied
• Block outbound access from the GeoNode server to cloud metadata endpoints at the firewall level

Patch Information

Organizations should consult the GitHub Security Advisory GHSA-hw9r-6m78-w6h3 for official patch information and upgrade guidance from GeoSolutions Group. The advisory contains details on affected versions and remediation steps.

Workarounds

• Deploy a reverse proxy or WAF in front of GeoNode to filter service registration requests containing internal IP addresses
• Implement network segmentation to isolate the GeoNode server from sensitive internal resources
• Configure egress filtering to prevent the GeoNode server from making outbound requests to private IP ranges
• Restrict access to the service registration endpoint to only trusted administrator accounts
• If cloud-hosted, configure instance metadata service (IMDS) to use IMDSv2 with session tokens to mitigate metadata extraction

# Example: Block outbound requests to private IP ranges using iptables
# Apply these rules on the GeoNode server to limit SSRF impact

# Block RFC1918 private ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Block loopback (if not needed)
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -p tcp --dport 443 -j DROP

# Block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP