CVE-2026-42352 json
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
published 2026-04-29 6 mo ago modified 2026-07-24 3 mo ago also GHSA-jgvc-94c8-3chc , PYSEC-2026-2986 , EUVD-2026-28859
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.
Patch / fix
- pypi pygeoapi 0.23.3
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| OSV | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pygeoapi | >=0.23.0, <0.23.3 |
0.23.3 |
Affected products
- geopython pygeoapi
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef
web
-
github.com
/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc
web
-
github.com
/geopython/pygeoapi/releases/tag/0.23.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-42352
advisory
-
github.com
/geopython/pygeoapi
package
-
pypi.org
/project/pygeoapi
package
-
github.com
/advisories/GHSA-jgvc-94c8-3chc
advisory
Sources
- CVE List CVE-2026-42352
- GitHub Advisory GHSA-jgvc-94c8-3chc
- NVD CVE-2026-42352
- OSV PYSEC-2026-2986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.