Critical GeoServer SQLi Vulnerability Allows Remote Code Execution

Key Takeaways

• A critical SQL injection vulnerability (GHSA-mqjf-5f49-2fjh) has been discovered in GeoServer.
• The flaw allows unauthenticated attackers to manipulate database queries via public OGC WMS and WFS services.
• Under specific PostgreSQL configurations, this vulnerability can lead to remote code execution (RCE) on the database server.
• Patches are available in GeoServer versions 2.27.6, 2.28.5, and 3.0.1; immediate updates are strongly recommended.

Unauthenticated SQL Injection Threatens GeoServer Deployments, Enables RCE

GeoServer administrators are urged to apply urgent updates following the disclosure of a severe unauthenticated SQL injection vulnerability. The flaw, residing within the jsonArrayContains filter function, could allow malicious actors to manipulate database queries through publicly exposed OGC WMS and WFS services. In scenarios where PostgreSQL databases are configured with overly permissive privileges, this vulnerability escalates to potential remote code execution (RCE) on the database host.

The issue gained public attention on August 12, 2026, when security researcher @q1uf3ng revealed the details. Within hours of the disclosure, exploitation attempts against exposed GeoServer instances were observed, indicating that attackers are actively targeting this vulnerability.

The core of the problem lies in how GeoServer leverages GeoTools to translate CQL filters into SQL queries for PostGIS-backed data stores. GeoServer commonly exposes CQL filter expressions through OGC interfaces like WFS and WMS, often without authentication, to facilitate public mapping applications.

Specifically, the vulnerable jsonArrayContains function processes user-supplied values intended for JSON or string fields. In affected GeoServer versions, this input was directly embedded into a PostgreSQL jsonb_path_exists() expression without sufficient sanitization or escaping. This critical oversight creates a direct pathway for an unauthenticated attacker to alter the SQL query generated by the application, leading to arbitrary SQL execution.

Conditions for Exploitation

Successful exploitation of this vulnerability requires specific environmental conditions: PostGIS version 12 or newer must be in use, and an exposed layer must contain a relevant String or JSON field. While a vulnerable GeoServer installation alone doesn’t guarantee exploitation, the risk significantly increases when public WFS or WMS services are exposed, a PostGIS data store is configured, and SQL function encoding is enabled.

According to Hadrian reports, a successful SQL injection can allow attackers to read, modify, or exfiltrate sensitive GeoServer database data. The severity of the impact is magnified when PostgreSQL accounts possess excessive privileges.

In the most critical scenarios, if the PostgreSQL role connected to GeoServer is a superuser or holds the pg_execute_server_program privilege, attackers can abuse the injected SQL to execute operating-system commands via PostgreSQL’s server-side program execution capabilities. This transforms the SQL injection into full remote code execution on the database server.

Even in the absence of such elevated privileges, the vulnerability remains critical. Attackers could still gain unauthorized access to geospatial records, metadata, credentials stored in accessible tables, or other sensitive information available to the compromised database role. While adopting least-privilege database accounts can mitigate the potential “blast radius,” it does not eliminate the fundamental SQL injection risk.

GeoServer addressed this issue with security releases published on August 14, 2026. Organizations must upgrade to GeoServer versions 2.27.6, 2.28.5, or 3.0.1, which incorporate the necessary GeoTools fixes (versions 33.6, 34.5, and 35.1 respectively) for the vulnerability tracked as GHSA-mqjf-5f49-2fjh.

The official advisory classifies the flaw as high severity. Third-party analyses assign a CVSS score of 9.8, reflecting its unauthenticated attack vector and the potential for remote code execution in vulnerable deployments, as highlighted by other security reports.

What You Should Do

• Patch Immediately: Upgrade all GeoServer deployments to versions 2.27.6, 2.28.5, or 3.0.1 without delay to apply the critical security fixes.
• Limit Public Exposure: Identify all internet-facing GeoServer instances. Restrict public access to WFS or WMS services through VPNs, IP allowlists, reverse proxies, or authenticated gateways whenever operationally feasible.
• Audit PostGIS Configurations: Review PostGIS data stores. Disable SQL function encoding if it is not strictly required for operational purposes.
• Implement Least Privilege: Ensure that GeoServer never connects to PostgreSQL using a superuser account. Review and revoke pg_execute_server_program grants unless they are explicitly and absolutely necessary.
• Monitor Logs: Actively inspect GeoServer and reverse-proxy logs for unusual CQL filter activity. Look for requests containing jsonArrayContains, malformed JSON path values, SQL keywords, comment markers, or repeated probing of WFS and WMS endpoints, as these may indicate active exploitation attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.