CVE-2026-76904: GeoTools PostGIS SQL Injection Vulnerability

CVE-2026-76904 Overview

GeoTools is an open source Java library providing tools for geospatial data processing. A SQL Injection vulnerability [CWE-89] affects the PostGIS DataStore implementation when executing OGC Filters. The jsonArrayContains(<column>, <pointer>, <value>) function writes the <value> parameter into generated SQL without proper escaping. The flaw impacts GeoTools versions 30.5 through the patched releases and requires PostGIS 12 or greater with a String or JSON field. Attackers can inject arbitrary SQL statements through OGC Filter expressions targeting exposed geospatial services.

Critical Impact
Unauthenticated network attackers can execute arbitrary SQL against the backing PostGIS database, potentially compromising confidentiality, integrity, and availability of geospatial data stores.

Affected Products

GeoTools versions 30.5 and later, prior to 33.6
GeoTools versions prior to 34.5
GeoTools versions prior to 35.1 with PostGIS 12+ DataStore

Discovery Timeline

2026-08-21 - CVE-2026-76904 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-76904

Vulnerability Analysis

The vulnerability resides in the FilterToSqlHelper class inside the jdbc-postgis module. When the jsonArrayContains OGC Filter function is translated into SQL, the third argument representing the search value is concatenated directly into a JSONPath expression embedded in the generated SQL. String values bypass parameterization and reach the database driver as attacker-controlled SQL fragments. Any application exposing OGC Filter parsing over the network (such as GeoServer WFS/WMS endpoints backed by PostGIS) inherits this exposure.

Root Cause

The root cause is missing input escaping in the code path that builds JSONPath predicates. The pre-patch implementation used "(@.%s == \"%s\")".formatted(jsonPath[lastIndex], value), inserting the raw value between quote characters without escaping embedded quotes or backslashes. This classic string-concatenation pattern [CWE-89] allows an attacker to break out of the JSONPath literal and append arbitrary SQL fragments handled by PostgreSQL.

Attack Vector

An attacker submits a crafted OGC Filter to any endpoint that invokes jsonArrayContains against a PostGIS-backed feature type. The filter's value argument contains characters that terminate the JSONPath string literal and introduce additional SQL syntax. No authentication or user interaction is required when the service exposes filter parsing publicly. The database executes the injected SQL under the privileges of the PostGIS connection pool account.

java

         } else if (value instanceof Double double1) {
             return "(@.%s == %f)".formatted(jsonPath[lastIndex], double1);
         }
-        return "(@.%s == \"%s\")".formatted(jsonPath[lastIndex], value);
+        String literal = escapeJsonLiteral(String.valueOf(value));
+        return "(@.%s == \"%s\")".formatted(jsonPath[lastIndex], literal);
     }

     private String constructPath(String[] jsonPath) {
// Source: https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176
// The patch introduces escapeJsonLiteral() to sanitize the value before embedding it in the JSONPath expression.

Detection Methods for CVE-2026-76904

Indicators of Compromise

Application logs containing OGC Filter requests referencing jsonArrayContains with unusual characters such as ", \, --, or ; in the value argument.
PostgreSQL query logs showing malformed JSONPath expressions or unexpected statements originating from the GeoTools connection pool user.
HTTP request logs on WFS/WMS endpoints containing filter parameters with encoded quote or comment sequences.

Detection Strategies

Inventory Java applications and web services using GeoTools between version 30.5 and the fixed releases, then correlate with PostGIS 12+ backends.
Enable PostgreSQL log_statement = 'all' on non-production hosts to observe SQL emitted by jsonArrayContains and identify anomalous patterns.
Deploy web application firewall rules that inspect OGC Filter payloads for injection metacharacters directed at jsonArrayContains function calls.

Monitoring Recommendations

Alert on PostgreSQL errors such as syntax error at or near originating from GeoTools-owned sessions.
Track query volume and duration for the connection pool account; sudden spikes may indicate exploitation attempts.
Forward web server and database logs to a centralized analytics platform for correlation of filter payloads with downstream SQL errors.

How to Mitigate CVE-2026-76904

Immediate Actions Required

Upgrade GeoTools to version 33.6, 34.5, or 35.1 depending on the branch currently deployed.
Restrict the PostGIS connection pool account to the minimum privileges required for read or write operations on the target schemas.
Audit deployed OGC services (GeoServer, custom GeoTools consumers) for exposure of jsonArrayContains on public endpoints.

Patch Information

Fixes are available in the Geotools Release 33.6, Geotools Release 34.5, and Geotools Release 35.1. Full technical details are documented in the GitHub Security Advisory GHSA-mqjf-5f49-2fjh and the corresponding security commit.

Workarounds

No official code-level workaround exists; upgrading is required to eliminate the flaw.
Reduce blast radius by configuring the PostGIS connection pool with a role limited to SELECT on required tables and no access to system catalogs.
Block or filter OGC requests that invoke jsonArrayContains at the reverse-proxy layer until the patched GeoTools version is deployed.

bash

# Restrict the PostGIS role used by GeoTools to reduce SQL Injection impact
psql -U postgres -d geodb <<'SQL'
REVOKE ALL ON SCHEMA public FROM geotools_app;
GRANT USAGE ON SCHEMA public TO geotools_app;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO geotools_app;
ALTER ROLE geotools_app NOSUPERUSER NOCREATEDB NOCREATEROLE;
SQL