PT-2026-36112 · Pypi · Pygeoapi

Elnimo-00 · CVE-2026-42352 · Published 2026-04-29 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pygeoapi versions 0.23.0 through 0.23.2

Description OGC API process execution requests can utilize the subscriber object to make requests to internal HTTP services. This allows for unauthorized interaction with internal network resources.

Recommendations Update to version 0.23.3. As a temporary workaround, disable process based resources in the pygeoapi configuration.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42352

GHSA-JGVC-94C8-3CHC

PYSEC-2026-2986

Affected Products

Pygeoapi

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42352.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42352 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42352 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2986 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jgvc-94c8-3chc · Vendor Advisory
• https://github.com/geopython/pygeoapi · Note
• https://github.com/geopython/pygeoapi/releases/tag/0.23.3 · Note
• https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc · Note
• https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef · Note
• https://reddit.com/r/VulnMatter/comments/1szui9p/resumen_diario_de_vulnerabilidades_30042026 · Reddit Post
• https://github.com/advisories/GHSA-jgvc-94c8-3chc · Note
• https://t.me/CVEtracker/53174 · Telegram Post
• https://twitter.com/CVEnew/status/2053131414292566139 · Twitter Post
• https://pypi.org/project/pygeoapi · Note