Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-42352

pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

geopython pygeoapi

  • >= 0.23.0, < 0.23.3affected

References