Loading
Generated remediation guidance and an executive summary. No account required.
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
Use CWE-918, Geosolutionsgroup vendor hub and Geonode product page to widen CVE-2026-39922 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2023-42439, CVE-2023-40017 and CVE-2023-28442 for nearby disclosures in the same product family.