PT-2026-36112 · Pypi · Pygeoapi

Elnimo-00 · Published 2026-04-29 · Updated 2026-05-09 · CVE-2026-42352

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pygeoapi versions 0.23.0 through 0.23.2

Description OGC API process execution requests can utilize the subscriber object to make requests to internal HTTP services. This allows for unauthorized interaction with internal network resources.

Recommendations Update to version 0.23.3. As a temporary workaround, disable process based resources in the pygeoapi configuration.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42352

GHSA-JGVC-94C8-3CHC

Affected Products

Pygeoapi

References · 9

• https://osv.dev/vulnerability/GHSA-jgvc-94c8-3chc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42352 · Security Note
• https://github.com/geopython/pygeoapi/releases/tag/0.23.3 · Note
• https://github.com/geopython/pygeoapi · Note
• https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc · Note
• https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef · Note
• https://twitter.com/CVEnew/status/2053131414292566139 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1szui9p/resumen_diario_de_vulnerabilidades_30042026 · Reddit Post
• https://t.me/CVEtracker/53174 · Telegram Post