CVE-2026-42352: pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-07-24
Weakness: CWE-918

Description

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Affected products

geopython pygeoapi: from 0.23.0, < 0.23.3

References

https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef
https://github.com/geopython/pygeoapi/releases/tag/0.23.3
https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc

Get alerted when CVE-2026-42352 or the next vulnerability affects your stack