CVE-2026-39922 GeoNode SSRF via Service Registration
Authenticated attackers can exploit insufficient URL validation in GeoNode's service registration to perform server-side request forgery and access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39922?
CVE-2026-39922 is a medium-severity server-side request forgery vulnerability in GeoNode, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
Weakness: CWE-918
Which versions are affected by CVE-2026-39922?
5 open source packages ship an affected version, including geonode. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
geonode PyPI | From 4.0.0 | 4.4.5, 5.0.2 |
geonode PyPI | From 4.0.0 | 4.4.5 |
geonode PyPI | From 4.0.0 | 4.4.5 |
geonode PyPI | From 5.0.0 | 5.0.2 |
geonode PyPI | From 5.0.0 | 5.0.2 |
Products include Geosolutionsgroup Geonode.
How do I fix CVE-2026-39922?
Upgrade geonode to a fixed version for your release line: 4.4.5 or 5.0.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-39922 being exploited?
There is no known exploitation of CVE-2026-39922 in the wild and no public exploit code.
Other vulnerabilities in GeoNode
- CVE-2023-42439 GeoNode SSRF Bypass to return internal host data
- CVE-2023-40017 Geonode Server Side Request Forgery vulnerability
- CVE-2023-28442 Geoserver for GeoNode sensitive information leak
- CVE-2023-26043 XML External Entity (XXE) injection in GeoServer style upload functionality
- CVE-2024-27091 GeoNode stored XSS to full account takeover
Sources
Also known as GHSA-hw9r-6m78-w6h3, PYSEC-2026-61.