GeoServer Unauthenticated SQL Injection (CVSS 9.8) Exploited in the Wild, PoC Public

TL;DR

A GeoServer unauthenticated SQL injection flaw is under active attack. It lives in the jsonArrayContains filter function against PostGIS layers. Attackers began probing within hours of public disclosure, and a proof-of-concept exploit that reaches remote code execution is now public. The flaw carries a CVSS score of 9.8.

Tracking ID: No CVE assigned at publication. The fix is tracked as GitHub advisory GHSA-mqjf-5f49-2fjh. The flaw is a regression of CVE-2023-25158.

Why It Matters

GeoServer is the most widely deployed open-source geospatial server. Government agencies, utilities, and defense contractors run it. Many expose OGC WMS and WFS endpoints without authentication.

This GeoServer unauthenticated SQL injection reaches those endpoints directly. Shadowserver reported over 1,500 exposed instances worldwide. Notably, the RondoDox botnet has already joined the exploitation attempts.

Exploitation Status

Security researcher @q1uf3ng disclosed the flaw as a zero-day on August 12, 2026. Exploitation attempts followed within hours, per Shadowserver and watchTowr sensors. Security firm Hadrian later published a technical analysis with a working proof-of-concept exploit that reached RCE. So far, much of the observed traffic looks like scanning and probing.

How the Attack Works

The bug sits in how GeoTools turns CQL filters into SQL for PostGIS data stores. According to Hadrian researcher Melvin Lammerts, the jsonArrayContains function drops a user-supplied value into an SQL expression without escaping.

Because that value comes straight from an HTTP request, an attacker can inject SQL. On PostGIS 12 or later, the flaw affects String or JSON fields. The injection can then escalate through Web Feature Service 1.0, which allows a second statement to run.

The impact depends on database privileges. If GeoServer connects as a PostgreSQL superuser or a role with program-execution rights, the flaw reaches OS command execution. Without those rights, the official GeoTools advisory notes the injection still exposes database data. This report omits any working exploit code.

Affected Versions

The flaw affects GeoServer deployments using the PostGIS data store with the jsonArrayContains function. It requires PostGIS 12 or greater with a String or JSON field.

Importantly, this is a regression of CVE-2023-25158. The older mitigation of enabling prepared statements and disabling encode functions does not stop this variant.

Patch and Mitigation Steps

Update to a fixed release without delay. GeoTools ships fixes in 33.6, 34.5, and 35.1. GeoServer ships fixes in 2.27.6, 2.28.5, and 3.0.1.

Until you patch, restrict public access to GeoServer. Use VPNs, IP allowlists, or authenticated gateways for OGC services. You should also run GeoServer’s database connection as a low-privilege role, never a superuser. Hadrian documented the full path from injection to RCE, and researchers have shared a public proor-of-concept exploit code.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.