CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Attackers can execute arbitrary SQL commands via unauthenticated OGC filters in GeoTools when using PostGIS layers with specific JSON fields.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76904?
CVE-2026-76904 is a critical SQL injection vulnerability in geotools, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Weakness: CWE-89
Which versions are affected by CVE-2026-76904?
6 open source packages ship an affected version, including org.geotools.jdbc:gt-jdbc-postgis.
| Package | Affected | Fixed in |
|---|---|---|
org.geotools.jdbc:gt-jdbc-postgis Maven | From 30.5 | 33.6 |
org.geotools.jdbc:gt-jdbc-postgis Maven | From 30.5 | 33.6 |
org.geotools.jdbc:gt-jdbc-postgis Maven | From 34.0 | 34.5 |
org.geotools.jdbc:gt-jdbc-postgis Maven | From 34.0 | 34.5 |
org.geotools.jdbc:gt-jdbc-postgis Maven | From 35.0 | 35.1 |
org.geotools.jdbc:gt-jdbc-postgis Maven | From 35.0 | 35.1 |
How do I fix CVE-2026-76904?
Upgrade org.geotools.jdbc:gt-jdbc-postgis to a fixed version for your release line: 33.6, 34.5 or 35.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-76904 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76904 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Sources
Also known as GHSA-mqjf-5f49-2fjh.