CVE-2026-42352 Details
Description
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.
A server-side request forgery (SSRF) vulnerability has been identified in pygeoapi versions 0.23.0 prior to 0.23.3. This vulnerability allows OGC API process execution requests to use the subscriber object to make requests to internal HTTP services. The issue arises because, by default, HTTP requests to internal resources are not allowed, but this restriction can be bypassed by enabling the 'allow_internal_requests' option in the process configuration.
Users are advised to update to pygeoapi version 0.23.3, which patches this vulnerability by disabling internal HTTP requests by default. The patch can be applied by updating the 'allow_internal_requests' directive in the process configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef | [email protected] | Source CodeVendor |
| https://github.com/geopython/pygeoapi/releases/tag/0.23.3 | [email protected] | Release NotesVendor |
| https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| geopython pygeoapi | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |