CVE-2026-42352: pygeoapi SSRF Vulnerability

CVE-2026-42352 Overview

CVE-2026-42352 is a Server-Side Request Forgery (SSRF) vulnerability in pygeoapi, a Python server implementation of the Open Geospatial Consortium (OGC) API suite of standards. The flaw affects versions 0.23.0 through versions prior to 0.23.3. OGC API process execution requests can abuse the subscriber object to issue requests against internal HTTP services. An unauthenticated remote attacker can leverage the pygeoapi server to reach link-local ranges and loopback addresses that are typically inaccessible from external networks. The maintainers patched the issue in version 0.23.3 by adding an allow_internal_requests configuration option that defaults to False.

Critical Impact
Unauthenticated network attackers can coerce pygeoapi to send arbitrary HTTP requests to internal services, enabling reconnaissance and access to metadata endpoints, internal APIs, and other loopback-bound resources.

Affected Products

pygeoapi 0.23.0 through versions prior to 0.23.3
Deployments exposing the OGC API Processes endpoints
Environments where pygeoapi has network reachability to internal HTTP services

Discovery Timeline

2026-05-08 - CVE-2026-42352 published to the National Vulnerability Database
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42352

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. pygeoapi implements OGC API - Processes, which permits clients to execute server-side processes asynchronously. Process execution requests support a subscriber object that specifies callback URLs for delivery of success, failure, or in-progress notifications. The server fetches these subscriber URLs without restricting their destination. An attacker submits an execution request with subscriber URLs pointing to internal HTTP endpoints. pygeoapi then issues outbound HTTP requests from the server context to those targets. This bypasses network segmentation and exposes cloud metadata services, internal admin APIs, and loopback-only daemons.

Root Cause

The process subscriber feature performs HTTP callbacks without validating that destination hosts fall outside private, loopback, or link-local address ranges. The pre-patch code path in pygeoapi/process/base.py accepted any user-supplied subscriber URL. The fix introduces an explicit allow_internal_requests option in the process configuration that gates whether internal destinations are permitted. The default value of False blocks loopback and link-local ranges.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends an OGC API Processes execution request containing a crafted subscriber object whose successUri, failedUri, or inProgressUri references an internal target. The pygeoapi server resolves the URL and issues an HTTP request, returning state changes to the attacker-controlled flow. Targets include cloud instance metadata services such as http://169.254.169.254/, container orchestration APIs, and any service bound to 127.0.0.1.

text

# Patch excerpt: docs/source/configuration.rst
           type: process  # REQUIRED (collection, process, or stac-collection)
           processor:
               name: HelloWorld  # Python path of process definition
+          # optional, allow for internal HTTP request execution
+          # if set to True, enables requests to link local ranges and loopback
+          # default: False
+          allow_internal_requests: True

Source: pygeoapi commit 3a63f5b

Detection Methods for CVE-2026-42352

Indicators of Compromise

Outbound HTTP requests from pygeoapi worker processes targeting 127.0.0.0/8, 169.254.0.0/16, or RFC1918 ranges.
POST requests to OGC API Processes endpoints (/processes/{processId}/execution) containing subscriber objects with URLs referencing internal hosts.
Unexpected egress from pygeoapi to cloud metadata endpoints such as 169.254.169.254 (AWS/Azure/GCP IMDS).
Process execution job entries whose subscriber URIs contain loopback, link-local, or private addresses.

Detection Strategies

Inspect pygeoapi access logs for execution requests and parse JSON payloads for subscriber.successUri, subscriber.failedUri, and subscriber.inProgressUri values referencing internal address space.
Apply network-layer monitoring to detect server-originated traffic toward metadata and loopback destinations not present in the application's baseline egress profile.
Add web application firewall rules that block request bodies containing subscriber URIs resolving to private or link-local ranges before they reach pygeoapi.

Monitoring Recommendations

Enable verbose logging in pygeoapi to capture full request payloads for process execution endpoints.
Forward pygeoapi and reverse-proxy logs to a centralized SIEM for correlation with outbound network flows.
Monitor for cloud IMDS access from any workload that does not legitimately require instance role credentials.

How to Mitigate CVE-2026-42352

Immediate Actions Required

Upgrade pygeoapi to version 0.23.3 or later as the primary remediation.
Audit existing pygeoapi process configurations and remove any allow_internal_requests: True entries that are not strictly required.
Restrict egress from pygeoapi hosts using network ACLs that deny traffic to loopback, link-local, and metadata endpoints.
Require IMDSv2 with hop limit of 1 on cloud instances running pygeoapi to mitigate metadata service abuse.

Patch Information

The maintainers fixed the issue in pygeoapi 0.23.3, released on GitHub. The patch in commit 3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef adds the allow_internal_requests configuration option, defaulting to False, and updates pygeoapi/process/base.py to validate subscriber URL destinations. Reference the GitHub Security Advisory GHSA-jgvc-94c8-3chc and the pygeoapi 0.23.3 release notes for full details.

Workarounds

Disable the OGC API Processes endpoints or the subscriber feature if patching is not immediately possible.
Place pygeoapi behind a forward proxy that filters outbound HTTP requests to private, loopback, and link-local destinations.
Deploy network segmentation so pygeoapi worker processes cannot reach internal management interfaces or cloud metadata services.

bash

# Verify pygeoapi version after upgrade
pip show pygeoapi | grep -i version

# Confirm allow_internal_requests is not enabled in process config
grep -R "allow_internal_requests" /etc/pygeoapi/