GeoServer SQL Injection Vulnerability Allows Remote Code Execution
An unauthenticated SQL injection flaw in GeoServer's jsonArrayContains filter function enables attackers to manipulate database queries and potentially achieve remote code execution.
GeoServer administrators are urged to update their systems immediately following the disclosure of a critical unauthenticated SQL injection vulnerability within the jsonArrayContains filter function. This flaw, publicly highlighted on August 12, 2026, by security researcher @q1uf3ng, allows attackers to manipulate database queries through publicly accessible OGC WMS and WFS services. Exploitation attempts began rapidly after disclosure, indicating that exposed GeoServer instances are already under active threat.
The vulnerability arises from how GeoServer, utilizing GeoTools, translates CQL filters into SQL queries for PostGIS data stores. When these filters are processed through OGC interfaces like WFS and WMS, which are often exposed without authentication for public mapping applications, the vulnerable jsonArrayContains function can be exploited. It processes user-controlled input intended for JSON or string fields and inserts it into a PostgreSQL jsonb_path_exists() expression without proper escaping. This allows an unauthenticated attacker to alter the SQL query generated by the application.
Successful exploitation requires specific conditions: a PostGIS data store version 12 or later, a relevant String or JSON field within an exposed layer, and a GeoServer installation. However, the presence of public WFS or WMS services, coupled with enabled function encoding, significantly elevates the risk. The impact can range from data exfiltration and modification to, in more severe configurations, remote code execution on the database host.
According to Hadrian reports, if the PostgreSQL account used by GeoServer possesses elevated privileges, such as being a superuser or having the pg_execute_server_program privilege, attackers can leverage the SQL injection to execute operating-system commands. This transforms the SQL injection into a full-blown remote code execution (RCE) vulnerability on the database server. Even without these elevated privileges, the flaw remains critical, allowing attackers to access sensitive geospatial data, metadata, credentials, or other information accessible to the database role.
Security releases addressing this vulnerability were published by GeoServer on August 14, 2026. Organizations are advised to upgrade to GeoServer versions 2.27.6, 2.28.5, or 3.0.1, which incorporate fixes in the underlying GeoTools library (versions 33.6, 34.5, and 35.1 respectively). The vulnerability is tracked as GHSA-mqjf-5f49-2fjh and has been classified as high severity, with third-party assessments noting a CVSS score of 9.8 due to its unauthenticated attack surface and RCE potential.
To mitigate this risk, administrators should promptly identify all internet-facing GeoServer deployments and audit their WFS and WMS services for unauthenticated access. Implementing access controls such as VPNs, IP allowlisting, reverse proxies, or authenticated gateways is crucial. Furthermore, organizations should review their PostGIS data store configurations, disable SQL function encoding where feasible, and ensure that GeoServer does not operate with a PostgreSQL superuser account. Auditing and revoking unnecessary privileges like pg_execute_server_program are also recommended steps.
Defenders are also encouraged to monitor GeoServer and reverse-proxy logs for suspicious activity, including unusual CQL filter patterns, malformed JSON path values, SQL keywords, or repeated probing of WMS/WFS endpoints. The rapid onset of exploitation attempts underscores the urgency of applying patches and reducing the attack surface to protect sensitive geospatial data and prevent potential system compromise.