A new, still-unpatched zero-day in GeoServer — the widely deployed open-source geospatial data server used across government, defense, science, and engineering organizations — is under active exploitation attempts just two days after public disclosure. The flaw sits in the jsonArrayContains OGC filter function and lets unauthenticated attackers inject arbitrary SQL, with a documented path to full remote code execution on PostgreSQL/PostGIS-backed deployments. As of this writing, no CVE identifier has been assigned and no official patch is available.

What happened

Security researcher @q1uf3ng publicly disclosed the vulnerability on X on August 12, 2026 at 10:46 UTC, without coordinating with the GeoServer project first. Exploitation attempts began within hours: researchers have logged hundreds of probe requests originating from a small pool of IP addresses. Current activity looks like reconnaissance — attackers fingerprinting exposed, vulnerable instances — rather than payload delivery at scale, but that’s expected to change as public proof-of-concept code circulates. A working PoC targeting the PostgreSQL RCE chain (GeoServer-jsonArrayContains-PG-RCE) is already on GitHub.

GeoServer has a history with this exact function: a related SQL injection in jsonArrayContains (affecting the OGC Filter/CQL expression language) was patched back in 2023 under GHSA-7g5f-wrx8-5ccf. This is a distinct, newly disclosed issue in the same code path, currently unpatched.

Technical details

  • Vulnerable component: the jsonArrayContains function in GeoServer/GeoTools’ OGC Filter and CQL expression handling, used to query JSON array attributes in WFS (Web Feature Service) requests against PostGIS and Oracle JDBC data stores.
  • Root cause: improper sanitization of user-supplied arguments when the function builds its underlying SQL query — the classic string-concatenation SQL injection pattern, reachable pre-authentication over the WFS endpoint.
  • Exploitation path: a crafted WFS request against a PostGIS-backed layer with a JSON-compatible attribute triggers statement stacking via the PostgreSQL JDBC driver (pgJDBC), allowing the attacker to append and execute arbitrary SQL statements beyond the original query.
  • RCE condition: if the database role GeoServer connects with has (or can reach) the pg_execute_server_program privilege — i.e., effectively superuser or a role granted server-side program execution — the attacker can use PostgreSQL’s COPY TO/FROM PROGRAM mechanism to execute arbitrary OS commands as the database service user. Standard, least-privileged database roles without that grant are limited to SQL injection (data read/write/exfiltration) rather than full RCE.
  • No authentication required: the WFS endpoint targeted is typically reachable without credentials on default GeoServer configurations.
  • CVE status: unassigned as of August 14, 2026.
  • Patch status: no official fix from the GeoServer project as of this writing.

Impact

GeoServer is deep infrastructure for geospatial data pipelines — it’s embedded in government mapping systems, environmental and scientific research platforms, utilities, defense contractor tooling, and commercial GIS products. An unauthenticated SQL injection with a real RCE path in that population is a serious exposure, and the fact that it’s unpatched with public exploitation and a public PoC already circulating raises the urgency well above typical zero-day disclosures. Instances backed by PostgreSQL/PostGIS with an overprivileged database role are the worst case: full OS-level command execution as the database service account, which can then be used to pivot further into the network. Even without the RCE precondition, the raw SQL injection exposes whatever data the GeoServer database role can reach — potentially including credentials or configuration stored alongside spatial data.

Mitigation

  • Identify exposed instances — inventory all GeoServer deployments and check whether the WFS endpoint (particularly jsonArrayContains usage against JSON-typed attributes in PostGIS/Oracle data stores) is reachable from the internet or untrusted networks.
  • Restrict network access to GeoServer’s WFS/WMS endpoints to trusted networks or authenticated reverse proxies until a patch ships — treat public exposure as the primary risk factor right now.
  • Apply least privilege to the database role GeoServer uses to connect to PostgreSQL: strip pg_execute_server_program and superuser rights from that role. This doesn’t stop the SQL injection but closes off the RCE escalation path entirely.
  • Disable or limit jsonArrayContains usage against JSON-typed attributes in PostGIS/Oracle data stores where feasible, pending an official fix.
  • Monitor logs for anomalous WFS requests, unexpected COPY ... PROGRAM activity in PostgreSQL query logs, or spikes in requests from unfamiliar source IPs against GeoServer endpoints.
  • Track the GeoServer GitHub security advisories page for the official patch and CVE assignment, and apply it immediately once released — treat this as a rolling, unresolved incident rather than a one-time check.

Sources: The Hacker News — Unpatched GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE, GitHub — GeoServer-jsonArrayContains-PG-RCE proof of concept, GeoServer GitHub Security Advisories — GHSA-7g5f-wrx8-5ccf (prior jsonArrayContains SQL injection).