High severity · published May 8, 2026
CVE-2026-42352
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
8.6
CVSS
0.5%
EPSS
No
On KEV
Description
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pygeoapi · geopython
>= 0.23.0, < 0.23.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42352
github.com
https://github.com/geopython/pygeoapi/commit/3a63f5b0cc6275e3ae0edb47726b13a43cdd90ef
github.com
https://github.com/geopython/pygeoapi/releases/tag/0.23.3
github.com
https://github.com/geopython/pygeoapi/security/advisories/GHSA-jgvc-94c8-3chc
More from pygeoapi
7.5
CVE-2026-42351
pygeoapi: Path Traversal in STAC FileSystemProvider