8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42352

CVE-2026-42352: pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact

OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services.

Patches

The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default (unless explicitly defined in configuration by a new allow_internal_requests directive.

The commit/fix can be found in 3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef.

Workarounds

Users can update existing applications by disabling process based resources in their pygeoapi config, until 0.23.3 can be installed and deployed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42352

CVE-2026-42352:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pygeoapi	pip	>= 0.23.0, < 0.23.3	0.23.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within the process manager of pygeoapi. When a user submits a job to an OGC API-compliant process, they can include a subscriber object with URLs for receiving notifications about the job's status (in-progress, success, failure). The functions _send_in_progress_notification, _send_success_notification, and _send_failed_notification in the BaseManager class were responsible for sending these notifications. Before the patch, these functions would directly use the requests.post method to send a request to the user-supplied URLs without any validation. This created a classic Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker could craft a process execution request with a subscriber object containing URLs pointing to internal network resources (e.g., http://127.0.0.1:8080/admin). The pygeoapi server would then execute these requests, allowing the attacker to scan the internal network, access sensitive endpoints, or interact with internal services. The patch mitigates this by introducing a validation function, is_request_allowed, which checks if a URL resolves to a private or loopback IP address. By default, requests to such internal addresses are blocked, unless explicitly enabled via a new configuration setting allow_internal_requests.

Vulnerable functions

BaseManager._send_in_progress_notification

pygeoapi/process/manager/base.py

This function was vulnerable because it made a POST request to a URL provided in the `subscriber.in_progress_uri` field without any validation. An attacker could provide a URL pointing to an internal service, causing a Server-Side Request Forgery (SSRF) vulnerability.

BaseManager._send_success_notification

pygeoapi/process/manager/base.py

This function was vulnerable because it made a POST request to a URL provided in the `subscriber.success_uri` field without any validation. An attacker could provide a URL pointing to an internal service, causing a Server-Side Request Forgery (SSRF) vulnerability.

BaseManager._send_failed_notification

pygeoapi/process/manager/base.py

This function was vulnerable because it made a POST request to a URL provided in the `subscriber.failed_uri` field without any validation. An attacker could provide a URL pointing to an internal service, causing a Server-Side Request Forgery (SSRF) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.