7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55864

CVE-2026-55864: GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server send requests to internal hosts that are not publicly reachable. When the outbound response was XML, the endpoint could store and return the fetched body, making the request forgery non-blind and enabling internal data disclosure, authorization bypass, and network reconnaissance. This issue is fixed in versions 4.2.17 and 4.4.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55864

CVE-2026-55864:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.geonetwork-opensource:gn-web-app	maven	>= 4.4.0, <= 4.4.11	4.4.12
org.geonetwork-opensource:gn-web-app	maven	>= 4.0.0, <= 4.2.16	4.2.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-55864 describes an unauthenticated Server-Side Request Forgery (SSRF) in the GeoNetwork Web Module's SLD tooling endpoint. Specifically, the POST /api/tools/ogc/sld endpoint accepted a caller-supplied WMS server URL and performed an unvalidated server-side HTTP GET request to it. This allowed an anonymous attacker to force the GeoNetwork server to make arbitrary HTTP requests, potentially to internal network resources.

My analysis focused on the provided GitHub pull request (PR #9343), which serves as the security patch. The key commit cc96ed7f8997c5d91385d1825c1223f81aac21df clearly shows the removal of the vulnerable functionality.

org.fao.geonet.api.sld.SldApi.buildSLD: This method, previously mapped to POST /api/tools/ogc/sld, was the public-facing API endpoint. The patch completely removes this method, indicating it was the entry point for the vulnerability. It accepted the serverURL parameter directly from the request.
org.geonetwork.map.wms.SLDUtil.parseSLD: This method was called by SldApi.buildSLD and was responsible for constructing and executing the HTTP GET request to the user-provided serverURL. The patch removes this method entirely from SLDUtil.java, confirming it contained the core logic for performing the unvalidated outbound request.

During exploitation, an attacker would send a POST request to the /api/tools/ogc/sld endpoint, providing a malicious URL in the serverURL parameter. This request would be handled by SldApi.buildSLD, which in turn would call SLDUtil.parseSLD. The parseSLD method would then execute the HTTP GET request to the attacker-controlled URL, leading to the SSRF. The removal of these two functions directly addresses the vulnerability by eliminating both the entry point and the execution mechanism of the SSRF.

Vulnerable functions

org.geonetwork.map.wms.SLDUtil.parseSLD

core/src/main/java/org/geonetwork/map/wms/SLDUtil.java

This static method directly implements the server-side request forgery. It takes a `URI` (derived from user input) and performs an unvalidated HTTP GET request using `HttpClient`. This allows an attacker to force the server to make arbitrary outbound HTTP requests to internal or external resources. The complete removal of this method in the patch confirms its role in the vulnerability. This function would appear in the stack trace when the server attempts to fetch content from the attacker-controlled URL, as it contains the `HttpClient.execute(HttpGet)` call which performs the network request. The `URI` parameter `url` is the direct source of the attacker-controlled input for the SSRF payload. The `layers` parameter is also user-controlled but less critical for the SSRF itself, though it contributes to the overall request construction. The lack of validation on the `url` parameter is the core issue here. The `IOUtils.toString` call on the response content also indicates that the response body was read, making it a non-blind SSRF if the content was XML, as described in the vulnerability summary. Therefore, this function is directly involved in both triggering the outbound request and processing its response, making it a critical vulnerable function. The `getGetStyleRequest` function, also removed, was a helper for constructing the URL, but `parseSLD` is where the actual HTTP request execution happens. The `HttpClient` and `HttpGet` classes are standard Java HTTP client components, and their usage here without proper URL validation is the root cause of the SSRF within this method. The `URI` object itself is constructed from the `serverURL` string provided by the user, which is the attacker-controlled input. The `execute` method of `HttpClient` is the point where the external request is initiated. The `IOUtils.toString` method then reads the response, which could contain sensitive information from internal services.

org.fao.geonet.api.sld.SldApi.buildSLD

services/src/main/java/org/fao/geonet/api/sld/SldApi.java

This method served as the unauthenticated API endpoint that received the malicious `serverURL` from an attacker. It then directly invoked the `SLDUtil.parseSLD` method, thereby triggering the SSRF vulnerability. Exploitation would involve sending a POST request to this endpoint with a crafted `url` parameter. The `@RequestParam("url") String serverURL` clearly indicates that the `serverURL` is directly taken from user input without prior validation. This function is the initial point of entry for the attacker's payload. Its complete removal signifies that it was a primary component of the vulnerable attack surface. The `new URI(serverURL)` call is where the raw user input is converted into a URI object, which is then passed to the `SLDUtil.parseSLD` method. This chain of calls makes `buildSLD` a critical vulnerable function as it directly exposes the `parseSLD` functionality to unauthenticated external input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.