Severity rationale: This critical, remotely reachable vulnerability allows an unauthenticated attacker to execute arbitrary SQL through the jsonArrayContains filter function. The official advisory assigns a CVSS score of 9.8. Host-level remote code execution is possible only when database permissions and available functionality permit it. Active probing has been observed, and security updates are available.
Critical GeoServer SQL Injection Targeted in Active Probing, Patches Released
OSGeo · GeoServer — Awaiting Assignment
A critical unauthenticated SQL injection vulnerability affecting GeoServer deployments using PostGIS 12 or later was publicly disclosed on August 12, 2026. WatchTowr subsequently observed hundreds of attempts to identify vulnerable systems. The reported activity appeared to be probing, with no publicly confirmed remote code execution or post-compromise activity. GeoServer has released versions 3.0.1, 2.28.5, and 2.27.6 to address the vulnerability. Affected organizations should patch immediately, restrict exposure where patching is delayed, and review activity dating back to the initial disclosure.
Key Facts
- Vendor
- OSGeo
- Product
- GeoServer
- CVE
- Awaiting Assignment
- CVSS
- 9.8
- Exploitation
- Suspected exploitation
- Affected versions
- GeoServer 3.0.0, GeoServer 2.28.0 through 2.28.4, GeoServer 2.27.1 through 2.27.5
- Fixed versions
- GeoServer 3.0.1, GeoServer 2.28.5, GeoServer 2.27.6
Summary
A critical unauthenticated SQL injection vulnerability affecting GeoServer deployments was targeted by automated probing within hours of its public disclosure. The flaw is located in the GeoTools PostGIS JDBC module used by GeoServer and affects the jsonArrayContains filter function.
WatchTowr reported hundreds of exploitation attempts from a small number of source IP addresses. However, the observed requests appeared to be probing for vulnerable systems and generated errors without progressing to confirmed remote code execution or post-exploitation activity.
GeoServer has released fixed versions. Organizations should upgrade immediately to GeoServer 3.0.1, 2.28.5, or 2.27.6, depending on their current release line.
What happened
On Wednesday, August 12, 2026, security researcher q1uf3ng publicly disclosed an unauthenticated SQL injection vulnerability involving GeoServer's jsonArrayContains filter function.
Within hours of the disclosure, researchers at WatchTowr began observing attempts to identify vulnerable internet-facing systems. Hundreds of requests reportedly originated from a small collection of source IP addresses.
The observed activity supports describing the threat as active probing or attempted exploitation. At the time of reporting, researchers had not publicly confirmed successful remote code execution, malware deployment, persistence, or other post-compromise activity connected to this vulnerability.
On August 14, the GeoServer project released versions 3.0.1, 2.28.5, and 2.27.6 to address the vulnerability. The official GitHub advisory, GHSA-mqjf-5f49-2fjh, was published on August 15.
Technical details
The vulnerability exists in the org.geotools:gt-jdbc-postgis component included with affected GeoServer releases. It occurs when GeoServer processes OGC filters containing the jsonArrayContains function against a PostGIS data store.
The vulnerable condition requires:
- PostGIS 12 or later
- A String or JSON database field
- Use of the
jsonArrayContainsfilter function - A vulnerable version of the GeoTools PostGIS JDBC module
The function accepts a column, pointer, and value. In affected versions, the supplied value is written into the generated SQL query without proper escaping. An unauthenticated attacker who can submit a crafted OGC filter may therefore cause GeoServer to execute arbitrary SQL expressions in the connected database.
The official advisory confirms arbitrary SQL execution. Remote code execution on the GeoServer host may be possible under specific configurations, but it depends on the underlying database platform, enabled database functions, and privileges assigned to the GeoServer database account. Host compromise should not be presented as an automatic result of exploitation.
The vulnerability is a regression of CVE-2023-25158 for the jsonArrayContains function. The older mitigations of enabling prepared statements and disabling encoded functions do not prevent exploitation of this regression.
Affected systems and fixed versions
The following GeoTools versions are affected:
- GeoTools 35.0, fixed in 35.1
- GeoTools 34.0 through 34.4, fixed in 34.5
- GeoTools 33.1 through 33.5, fixed in 33.6
Corresponding fixed GeoServer releases are:
- GeoServer 3.0.1
- GeoServer 2.28.5
- GeoServer 2.27.6
GeoServer 2.27 has reached end of life. Version 2.27.6 should be treated as an immediate security update, followed by migration to a currently supported GeoServer release.
Deployments that do not use PostGIS 12 or later with a String or JSON field are not within the configuration described by the official advisory. The new advisory does not identify Oracle JDBC data stores as affected by this regression.
Why it matters
GeoServer is commonly used to publish and process geospatial information across government, utilities, transportation, agriculture, telecommunications, research, and other sectors.
Successful SQL injection could expose or modify sensitive geospatial data, disrupt services, or allow an attacker to abuse database functionality. Environments that connect GeoServer to a highly privileged database account face greater risk, including the potential for operating system command execution under certain configurations.
GeoServer also has a history of widespread exploitation. CVE-2024-36401 was previously exploited against exposed GeoServer systems and added to the CISA Known Exploited Vulnerabilities catalog. Rapid probing of this new vulnerability indicates that attackers continue to closely monitor GeoServer disclosures.
Recommended actions
- Upgrade immediately to GeoServer 3.0.1, 2.28.5, or 2.27.6.
- Confirm that the upgraded installation includes GeoTools 35.1, 34.5, or 33.6.
- Restrict public access to GeoServer if the update cannot be deployed immediately.
- Identify deployments using PostGIS 12 or later with String or JSON fields.
- Review requests received since August 12 for suspicious use of
jsonArrayContains. - Investigate unusual SQL errors, database activity, process creation, file changes, or outbound connections from GeoServer hosts.
- Limit the GeoServer database account to the minimum permissions required.
- Do not rely on prepared statements or disabling encoded functions as protection against this regression.
- Treat evidence of successful SQL execution as a potential incident and begin compromise assessment.
Technical details
The vulnerability is an unauthenticated SQL injection in the GeoTools PostGIS JDBC module used by GeoServer. When the jsonArrayContains function is executed against PostGIS 12 or later with a String or JSON field, attacker-controlled input can be written into the generated SQL query without proper escaping.
This behavior may allow a remote attacker to execute arbitrary SQL expressions in the connected database. The impact depends on the permissions assigned to the GeoServer database account and the functionality enabled by the database. Remote code execution on the underlying host is possible in certain privileged configurations but is not an automatic outcome.
The vulnerability is tracked as GHSA-mqjf-5f49-2fjh and has a CVSS score of 9.8. It is a regression of CVE-2023-25158 affecting the jsonArrayContains function. The previous mitigations involving prepared statements and encoded functions are not effective against this regression.
Detection & hunting
- Review GeoServer and reverse proxy logs for requests containing
jsonArrayContains, particularly requests received on or after August 12, 2026. - Investigate malformed OGC, CQL, ECQL, WFS, or filter requests that produced HTTP 500 responses, database exceptions, or unusual response times.
- Examine PostGIS logs for unexpected SQL expressions executed by the GeoServer service account.
- Correlate suspicious requests with subsequent database access, authentication changes, file creation, or configuration modifications.
- Monitor for unexpected processes launched by Java, Tomcat, Jetty, or the GeoServer service account.
- Investigate shell execution, scripting engines, download utilities, or newly created executable files on the GeoServer host.
- Review outbound connections from the GeoServer host for unfamiliar destinations, reverse-shell behavior, beaconing, or unexpected file transfers.
- Preserve relevant web, application, database, endpoint, and network logs if evidence suggests successful SQL execution.
Recommended actions
Patch Immediately
- Upgrade affected installations to GeoServer 3.0.1, 2.28.5, or 2.27.6.
- Verify that the deployment includes GeoTools 35.1, 34.5, or 33.6.
- Test the updated service and confirm that all expected geospatial functions remain operational.
Contain Exposure
- Restrict internet access to GeoServer if the security update cannot be deployed immediately.
- Limit access to authorized IP ranges, trusted reverse proxies, or a VPN.
- Do not rely on prepared statements or disabling encoded functions as a workaround.
Hunt and Investigate
- Review GeoServer, web server, and database activity dating back to August 12, 2026.
- Investigate suspicious jsonArrayContains requests, SQL errors, process creation, file changes, and outbound connections.
- Begin incident response procedures if evidence indicates successful SQL execution or host compromise.
Harden and Monitor
- Confirm whether the environment uses PostGIS 12 or later with String or JSON fields.
- Apply least privilege to the database account used by GeoServer.
- Maintain enhanced application, database, endpoint, and network monitoring after patching.
Compliance relevance
Sources
- Hackers Exploiting Unpatched GeoServer Zero · SecurityWeek
- GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE · Thehackernews
- GeoServer Zero-Day Is Already Being Probed. That’s the Problem · Securityaffairs
- GeoServer 3.0.1 Release · Geoserver
- GeoServer 2.28.5 Release · Geoserver
- GeoServer 2.27.6 Release · Geoserver
Disclaimer: CyberBrief HQ articles are for informational purposes only and do not constitute security advice for any specific environment. Always validate guidance against your own controls and vendor advisories before acting.