GeoServer’s Unauthenticated SQL injection Vulnerability Enables RCE Attacks

GeoServer administrators should urgently update affected systems after researchers disclosed an unauthenticated SQL injection flaw in the jsonArrayContains filter function.

The issue can allow attackers to manipulate database queries via publicly accessible OGC WMS and WFS services and, under dangerous PostgreSQL privilege configurations, potentially execute commands on the database host.

Security researcher @q1uf3ng publicly highlighted the issue on August 12, 2026. Exploitation attempts began within hours, demonstrating that exposed GeoServer instances are already attracting attacker attention.

The flaw affects GeoServer’s use of GeoTools when translating CQL filters into SQL queries for PostGIS-backed data stores. GeoServer accepts CQL filter expressions through OGC interfaces such as WFS and WMS, which are often made available without authentication to support public mapping applications.

The vulnerable jsonArrayContains function processes user-controlled values intended for JSON or string fields. In affected versions, this input was inserted into a PostgreSQL jsonb_path_exists() expression without adequate escaping. This creates a path for an unauthenticated attacker to alter the SQL query generated by the application.

The issue requires PostGIS 12 or later and a relevant String or JSON field in an exposed layer. A vulnerable GeoServer installation alone does not guarantee exploitation. However, public WFS or WMS exposure, a PostGIS data store, and enabled function encoding significantly increase the risk.

GeoServer SQL injection Vulnerability

According to Hadrian reports, successful exploitation can allow attackers to read, modify, or extract GeoServer database data, with greater impact when PostgreSQL accounts have excessive privileges.

If the PostgreSQL role is a superuser or has the pg_execute_server_program privilege, injected SQL may be abused to run operating-system commands through PostgreSQL server-side program execution features. In that scenario, the SQL injection can become remote code execution on the database server.

Even where this privilege is absent, the flaw remains critical because attackers may still access geospatial records, metadata, credentials stored in reachable tables, or other information available to the database role. Least-privilege database accounts reduce the blast radius but do not remove the underlying SQL injection risk.

GeoServer published security releases on August 14, 2026. Organizations should upgrade to GeoServer 2.27.6, 2.28.5, or 3.0.1, which include fixed GeoTools versions for the issue tracked as GHSA-mqjf-5f49-2fjh. The associated GeoTools fixes are 33.6, 34.5, and 35.1.

The advisory classifies the flaw as high severity, while third-party reporting cites a CVSS score of 9.8 due to its unauthenticated attack surface and potential for remote code execution in privileged deployments.

Administrators should immediately identify all internet-facing GeoServer deployments and determine whether WFS or WMS services accept unauthenticated requests. Restrict public access through VPNs, IP allowlists, reverse proxies, or authenticated gateways where possible.

Teams should also audit PostGIS data stores, turn off SQL function encoding where operationally feasible, and ensure GeoServer never connects with a PostgreSQL superuser account. Review grants for pg_execute_server_program and remove permissions unless they are explicitly required.

Finally, defenders should inspect GeoServer and reverse-proxy logs for unusual CQL filter activity, especially requests containing jsonArrayContains, malformed JSON path values, SQL keywords, comment markers, or repeated probing of WFS and WMS endpoints. Active scanning began quickly after disclosure, making prompt patching and exposure reduction essential.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post GeoServer’s Unauthenticated SQL injection Vulnerability Enables RCE Attacks appeared first on Cyber Security News.