Executive Summary

CVE-2026-39922 is a Server-Side Request Forgery (SSRF) vulnerability found in GeoNode versions before 4.4.5 and 5.0 before 5.0.2. It exists in the service registration endpoint, where authenticated users can submit a specially crafted service URL during form validation.

This crafted URL causes the server to make outbound network requests to arbitrary URLs without proper validation. The vulnerability arises because the Web Map Service (WMS) handler does not properly filter private IP addresses or enforce an allowlist.

As a result, attackers can probe internal network resources such as loopback addresses, private IP ranges defined by RFC1918, link-local addresses, and cloud metadata services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker to make the GeoNode server send requests to internal or protected network resources that are normally inaccessible from outside.

By exploiting this, attackers can gather sensitive information about the internal network, potentially access cloud metadata services, and perform reconnaissance that could lead to further attacks.

The impact includes unauthorized access to internal systems, exposure of sensitive data, and increased risk of lateral movement within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated attacker submitting a crafted service URL to the GeoNode service registration endpoint, triggering outbound requests to arbitrary URLs. Detection would involve monitoring for unusual outbound HTTP requests originating from the GeoNode server, especially to internal IP ranges such as loopback addresses, RFC1918 private IP ranges, link-local addresses, or cloud metadata service URLs.

Commands to detect potential exploitation attempts could include network monitoring tools or logs inspection on the GeoNode server to identify outbound requests to suspicious internal or metadata service IPs.

• Use tcpdump or similar to capture outbound traffic from the GeoNode server, filtering for internal IP ranges, e.g.: tcpdump -i eth0 dst net 127.0.0.0/8 or dst net 10.0.0.0/8 or dst net 169.254.0.0/16
• Check GeoNode application logs for requests to the service registration endpoint containing unusual or suspicious service URLs.
• Use curl or wget commands to test the service registration endpoint with crafted URLs to verify if the server triggers outbound requests.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade GeoNode to a fixed version: 4.4.5 or later for the 4.x branch, or 5.0.2 or later for the 5.x branch.

Until an upgrade can be performed, restrict access to the service registration endpoint to trusted authenticated users only, and monitor for suspicious activity.

Implement network-level controls to block outbound requests from the GeoNode server to internal IP ranges and cloud metadata service IPs to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-39922 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0