A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr.
The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution (RCE). The security defect remains unpatched.
It was first disclosed on August 12, 2026, at 10:46 UTC, by a researcher named @q1uf3ng on X. “GeoServer jsonArrayContains unauthorized SQL injection, and in the case of the sa [system administrator] database, it’s naturally possible to achieve RCE,” the researcher said.
The threat intelligence and exposure management platform said it began to observe exploitation attempts within hours of public disclosure, and that it has seen hundreds of attempts originating from a small pool of IP addresses.
“Currently, we’re seeing attackers probe to identify vulnerable systems across the internet, triggering errors and not proceeding further,” Jake Knott, principal security researcher at watchTowr, told The Hacker News in a statement.
“However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. More importantly, under certain configurations, this latest vulnerability could ultimately lead to remote code execution.”
In the absence of a patch, organizations running GeoServer are advised to identify exposed instances, restrict public access, and monitor for a vendor fix.
In 2024, a critical security flaw impacting GeoServer GeoTools (CVE-2024-36401, CVSS score: 9.8) came under active exploitation to turn compromised devices into DDoS and cryptocurrency mining botnets, and residential proxies.
Update
GeoServer has released versions 3.0.1, 2.28.5, and 2.27.6 to address the critical SQL injection vulnerability, which has now been assigned the GitHub security advisory identifier “GHSA-mqjf-5f49-2fjh.” It carries a CVSS score of 9.8 out of 10.0.
“An SQL injection vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function,” the project maintainers said in an alert, adding it requires PostGIS 12 or greater with a String or JSON field.
“For PostGIS 12 and greater, jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.”
The issue impacts the following versions of the Maven package “org.geotools:gt-jdbc-postgis” –
- 35.0 (Fixed in 35.1)
- >=34.0 (Fixed in 34.5)
- >=33.1 (Fixed in 33.6)
The maintainers also noted that the vulnerability is a regression of CVE-2023-25158 (CVSS score: 9.8), another critical SQL injection vulnerability that was addressed alongside CVE-2023-25157 in February 2023.
When reached for comment, Jody Garnett, a project owner at GeoCat, told The Hacker News the vulnerability was a known issue in the GeoTools library and that it has been addressed in the aforementioned three versions of GeoServer.
Hadrian has since published additional details of the vulnerability, stating it resides in the GeoTools code responsible for translating Common or Contextual Query Language (CQL) filters into SQL for PostGIS-backed datastores.
“An attacker-controlled value is interpolated directly into a PostgreSQL jsonb_path_exists() expression without escaping,” security researcher Melvin Lammerts said.
Specifically, the vulnerable function directly drops a user-supplied value that originates from an HTTP request into an SQL literal with no sanitization and input escaping, thereby opening the door to SQL injection. This, in turn, can be turned into RCE by leveraging Web Feature Service (WFS) 1.0, which provides a path where a second PostgreSQL statement executes at the top level of the query.
“If GeoServer connects to PostgreSQL using a superuser or a role with pg_execute_server_program, this escalates to OS command execution on the database host,” Lammerts explained. “Without those elevated PostgreSQL privileges, the SQL injection still works and can be used to access data available to the database user.”
(The story has been updated to include details of the fix.)
