# CVE-2026-55864: Core-GeoNetwork - SSRF

> Live exploitation tracking for CVE-2026-55864 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-55864

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.8
- **Public exploit available:** Yes
- **Affected products:** GeoNetwork Core-GeoNetwork
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** web_application

## Description

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.

## CrowdSec analysis

[CVE-2026-55864](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-55864) is a server-side request forgery (SSRF) vulnerability in GeoNetwork versions before 4.2.17 and 4.4.12. An unauthenticated attacker can abuse the `/api/tools/ogc/sld` endpoint to make the server request internal hosts and, when responses contain XML, retrieve the fetched data—enabling internal information disclosure, authorization bypass, and network reconnaissance. The vulnerability is fixed in GeoNetwork 4.2.17 and 4.4.12.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-55864 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the `/srv/api/tools/ogc/sld` endpoint with a POST request that supplies a URL in the `url` parameter, coercing GeoNetwork to make a server-side request to an attacker-controlled or internal host.

## Timeline

- 2026-09-15: CVE Published. CVE-2026-55864 is published to NVD.
- 2026-10-29: Rule Released. CrowdSec releases a rule to detect CVE-2026-55864 exploitation attempts against the CrowdSec Network.
- 2026-11-04: First exploitation attempt seen by CrowdSec

## References

- https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj
- https://github.com/geonetwork/core-geonetwork/pull/9343
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.17
- https://github.com/geonetwork/core-geonetwork/pull/9344
- https://github.com/geonetwork/core-geonetwork/commit/17fdae28a5a51996bf5ff7f7e8236332c74eab77
- https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.12
- https://github.com/geonetwork/core-geonetwork/commit/a80d535c842e6af589d0bac37e7fe4ba01193757
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55864.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-55864) follows observed exploitation activity for CVE-2026-55864. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.