highCVE-2026-55864Sep 9, 2026

CVE-2026-55864: GeoNetwork Unauthenticated SSRF in SLD Tool

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Any anonymous user can make a GeoNetwork server silently fetch arbitrary internal URLs by abusing the SLD map-styling endpoint, allowing internal network reconnaissance and data disclosure with no…

Packageorg.geonetwork-opensource:gn-web-app
Ecosystemmaven
Affected>= 4.4.0, <= 4.4.11
Fixed in4.4.12
CVE-2026-55864: GeoNetwork Unauthenticated SSRF in SLD Tool

The problem

The SLD endpoint at POST /api/tools/ogc/sld accepts a caller-supplied WMS server URL and passes it directly to SLDUtil.parseSLD() with no authentication check, no scheme validation, and no SSRF guard.

Any unauthenticated attacker can point this parameter at internal hosts, cloud metadata endpoints, or localhost services. When the internal response is XML, the server parses and returns it to the attacker, making this a non-blind SSRF. Even non-XML responses confirm host/port liveness.

Proof of concept

A working proof-of-concept for CVE-2026-55864 in org.geonetwork-opensource:gn-web-app, with the exact payload below.

http
POST /geonetwork/api/tools/ogc/sld?serverURL=http://169.254.169.254/latest/meta-data/ HTTP/1.1
Host: target-geonetwork.example.com
Content-Type: application/x-www-form-urlencoded

(no body or credentials required)

The root cause is CWE-918: the serverURL parameter is cast directly to a URI and fetched server-side inside SLDUtil.parseSLD() with no allowlist, scheme restriction, or private-range block. No @PreAuthorize annotation protects the endpoint, so the request requires zero authentication.

The patch in PR #9343 introduces URL validation before the outbound fetch: it rejects non-HTTP(S) schemes, blocks RFC-1918 and loopback address ranges, and adds an allowlist check. This prevents arbitrary internal destinations from being reached.

The fix

Upgrade to GeoNetwork 4.4.12 (or 4.2.17 for the stable branch). The fix in PR #9343 adds pre-fetch URL validation that rejects private IP ranges, loopback addresses, and non-HTTP(S) schemes. As a short-term workaround, block external access to POST /api/tools/ogc/sld at the reverse-proxy or WAF layer and require authentication for all /api/* routes.

Reported by Brexard (via Ethiack).

References: [1][2][3]

Related research