CVE-2026-39922

CVE-2026-39922 is a server-side request forgery (SSRF) vulnerability affecting GeoNode versions 4.4.5, 5.0.2, and earlier releases within those version branches. The flaw exists in the service registration endpoint where insufficient URL validation in the WMS service handler allows authenticated attackers to craft malicious service URLs that bypass private IP filtering and allowlist protections during form validation. The vulnerability carries a CVSS score of 6.3 (Medium), characterized by network-based attack vectors requiring low complexity and valid authentication credentials. Exploiting this flaw enables attackers to probe internal network infrastructure including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services, potentially resulting in limited impact to confidentiality, integrity, and availability. Exploitation status remains minimal with no current evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and maintains an extremely low EPSS score of 0.00038, indicating negligible probability of exploitation. Community attention is low, reflecting the specialized nature of the affected product and the requirement for authenticated access to trigger the vulnerability.