Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39922 GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability in the service registration endpoint that allows authentica… https://www.cve.org/CVERecord?id=CVE-2026-39922
Post summary
The message announces a server‑side request forgery vulnerability in GeoNode (CVE‑2026‑39922), detailing affected versions but offering no exploit, mitigation, or active attack information.
CVE-2026-39922 Server-Side Request Forgery in GeoNode 4.0 and 5.0 Service Regist... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39922 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post announces CVE‑2026‑39922 as a Server‑Side Request Forgery affecting GeoNode 4.0 and 5.0, providing a link to additional details but no proof of concept, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | geosolutionsgroup | geonode | - | - | - |