Unauthenticated Server-Side Request Forgery in GeoNetwork Web Module

GeoNetwork version 4.4.0 through 4.4.11 and 4.0.0 through 4.2.16 are affected by an unauthenticated Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-55864. The vulnerability resides in the SLD tooling endpoint located at /api/tools/ogc/sld. This endpoint accepts a WMS server URL parameter from an unauthenticated user and performs a server-side HTTP GET request to the provided destination without validation.

If the requested resource returns XML content, the application may store and display the output, turning this into a non-blind SSRF. Attackers can leverage this to conduct network reconnaissance against internal infrastructure, interact with internal services that are not publicly exposed, or potentially exfiltrate sensitive information from internal files if they return XML-based responses. This poses a significant risk to internal network segmentation and data confidentiality.

Impact

The vulnerability allows unauthenticated attackers to probe internal networks, bypass firewall restrictions to access internal services, and exfiltrate internal configuration data or other sensitive resources formatted as XML. This could lead to full internal network reconnaissance and unauthorized data disclosure.

Recommendation

• Upgrade to GeoNetwork 4.4.12 or 4.2.17 to remediate CVE-2026-55864.
• Implement network egress filtering on the GeoNetwork server to restrict outbound connections to known, trusted WMS server endpoints.
• Deploy detection rules to monitor for unauthorized requests to the /api/tools/ogc/sld endpoint.