Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zfm7-uxa4-m7c9
Vulnerability ID VCID-zfm7-uxa4-m7c9
Aliases CVE-2026-39922
GHSA-hw9r-6m78-w6h3
PYSEC-2026-61
Summary GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-918 Server-Side Request Forgery (SSRF)
System Score Found at
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2026-39922
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2026-39922
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2026-39922
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2026-39922
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hw9r-6m78-w6h3
cvssv3.1 6.3 https://github.com/GeoNode/geonode
cvssv4 5.3 https://github.com/GeoNode/geonode
generic_textual MODERATE https://github.com/GeoNode/geonode
cvssv3.1 6.3 https://github.com/GeoNode/geonode/releases/tag/4.4.5
cvssv4 5.3 https://github.com/GeoNode/geonode/releases/tag/4.4.5
generic_textual MODERATE https://github.com/GeoNode/geonode/releases/tag/4.4.5
cvssv3.1 6.3 https://github.com/GeoNode/geonode/releases/tag/5.0.2
cvssv4 5.3 https://github.com/GeoNode/geonode/releases/tag/5.0.2
generic_textual MODERATE https://github.com/GeoNode/geonode/releases/tag/5.0.2
cvssv3.1 6.3 https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
cvssv4 5.3 https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
ssvc Track https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
cvssv3.1 6.3 https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
cvssv4 5.3 https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
generic_textual MODERATE https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2026-39922
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-39922
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-39922
cvssv3.1 6.3 https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
cvssv4 5.3 https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
generic_textual MODERATE https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
ssvc Track https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-39922
https://github.com/GeoNode/geonode
https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
CVE-2026-39922 https://nvd.nist.gov/vuln/detail/CVE-2026-39922
geonode-ssrf-via-service-registration https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
GHSA-hw9r-6m78-w6h3 https://github.com/advisories/GHSA-hw9r-6m78-w6h3
GHSA-hw9r-6m78-w6h3 https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/GeoNode/geonode
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/GeoNode/geonode
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/GeoNode/geonode/releases/tag/4.4.5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/GeoNode/geonode/releases/tag/4.4.5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/GeoNode/geonode/releases/tag/5.0.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/GeoNode/geonode/releases/tag/5.0.2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T17:35:42Z/ Found at https://github.com/GeoNode/geonode/security/advisories/GHSA-hw9r-6m78-w6h3
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2026-61.yaml
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-39922
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-39922
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L Found at https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T17:35:42Z/ Found at https://www.vulncheck.com/advisories/geonode-ssrf-via-service-registration
Exploit Prediction Scoring System (EPSS)
Percentile 0.13791
EPSS Score 0.00044
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:46:03.820787+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/39xxx/CVE-2026-39922.json 38.6.0