Core-GeoNetwork - SSRF (CVE-2026-55864)
Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.
psychologyCrowdSec Analysis
CVE-2026-55864 is a server-side request forgery (SSRF) vulnerability in GeoNetwork versions before 4.2.17 and 4.4.12. An unauthenticated attacker can abuse the /api/tools/ogc/sld endpoint to make the server request internal hosts and, when responses contain XML, retrieve the fetched data—enabling internal information disclosure, authorization bypass, and network reconnaissance. The vulnerability is fixed in GeoNetwork 4.2.17 and 4.4.12.
CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-55864 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target the /srv/api/tools/ogc/sld endpoint with a POST request that supplies a URL in the url parameter, coercing GeoNetwork to make a server-side request to an attacker-controlled or internal host.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-15 |
| Rule Released | 2026-10-29 |
Remediation & Protection
External References
- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj
- https://github.com/geonetwork/core-geonetwork/pull/9343
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.17
- https://github.com/geonetwork/core-geonetwork/pull/9344
- https://github.com/geonetwork/core-geonetwork/commit/17fdae28a5a51996bf5ff7f7e8236332c74eab77
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.12
- https://github.com/geonetwork/core-geonetwork/commit/a80d535c842e6af589d0bac37e7fe4ba01193757
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55864.yaml