GeoServer PostGIS SQL injection regression under active scanning

A critical SQL injection vulnerability with a CVSS 9.8 score has been discovered in GeoServer, which under certain configurations can lead to remote code execution (RCE). The vulnerability is tracked as GHSA-mqjf-5f49-2fjh and affects the GeoTools library in the PostGIS handling component. The developers have already released fixes for three supported branches — GeoServer 3.0.1, 2.28.5 and 2.27.6. Organizations using GeoServer with PostGIS 12 and above need to update immediately, since according to watchTowr the internet is already seeing scanning activity for vulnerable instances.

Technical details of the vulnerability

The vulnerability is located in the PostGIS DataStore implementation of the GeoTools library. According to the official security advisory on GitHub, the issue arises when executing OGC filters using the jsonArrayContains function. In PostGIS versions 12 and above, the call jsonArrayContains(<column>, <pointer>, <value>) writes the <value> parameter into the generated SQL query without escaping, which opens a direct vector for SQL injection.

Exploitation requires PostGIS version 12 or higher with a field of type String or JSON. With database system administrator privileges, the vulnerability reportedly allows attackers to achieve remote code execution.

Affected versions of the Maven package org.geotools:gt-jdbc-postgis:

• Version 35.0 — fixed in 35.1
• Versions ≥34.0 — fixed in 34.5
• Versions ≥33.1 — fixed in 33.6

Corresponding GeoServer releases: 3.0.1, 2.28.5 and 2.27.6.

Regression of a previously fixed vulnerability

It is particularly noteworthy that the project maintainers have classified this vulnerability as a regression of the previously fixed CVE-2023-25158 (CVSS 9.8) — a critical SQL injection vulnerability that was eliminated in February 2023 together with CVE-2023-25157. This means that the fix introduced more than three years ago was unintentionally undone in the course of subsequent development — a situation typical for large open-source projects, but no less dangerous for that.

Jody Garnett from GeoCat has reportedly confirmed that the vulnerability was a known issue in the GeoTools library and that it has been addressed in the three specified GeoServer releases.

Observed scanning activity

The vulnerability was publicly disclosed on August 12, 2026, by a researcher using the handle @q1uf3ng on the social network X. According to watchTowr, attempts to exploit it began to be recorded within a few hours of publication — hundreds of requests from a small pool of IP addresses.

Important caveat: at the time of writing, the observed activity, according to watchTowr researcher Jake Knott, was limited to probing — attackers were identifying vulnerable systems by triggering errors, but were not proceeding to full exploitation. The initial watchTowr report with telemetry and indicators of compromise is not publicly available, so the scale of activity should be assessed with caution. It is more accurate to classify the exploitation status as observed scanning, rather than confirmed exploitation in real-world attacks.

Historical threat landscape for GeoServer

GeoServer has repeatedly been targeted by attackers. In 2024, the critical vulnerability CVE-2024-36401 (CVSS 9.8) in the GeoServer GeoTools component was, according to available data, exploited to build botnets — both for DDoS attacks and cryptocurrency mining, as well as for creating residential proxy networks. This precedent makes the current vulnerability particularly significant: given the public description of the attack vector and attackers’ historical interest in the platform, the transition from scanning to active exploitation is only a matter of time.

Impact assessment

GeoServer is widely used in government geoinformation systems, mapping services, infrastructure projects and scientific organizations. Instances exposed to the internet and running PostGIS 12+ with fields of type String or JSON are at the highest risk. Successful exploitation can lead to complete compromise of the database server, leakage of geospatial data, and use of the compromised infrastructure as a foothold for further attacks.

Response recommendations

1. Immediate update: upgrade GeoServer to version 3.0.1, 2.28.5 or 2.27.6, depending on the branch you use. At the GeoTools library level, update org.geotools:gt-jdbc-postgis to version 35.1, 34.5 or 33.6 respectively.
2. Inventory: identify all GeoServer instances in your infrastructure, especially those exposed to the internet.
3. Access restriction: if immediate updating is not possible, close public access to GeoServer using network access controls — firewalls, VPNs, and allowlists of IP addresses.
4. Monitoring: check logs for abnormal OGC requests using the jsonArrayContains function, especially those containing atypical values in parameters.
5. PostGIS version check: the vulnerability is relevant only for PostGIS 12 and above. If an earlier version is used, there is no direct risk, but updating GeoServer is still recommended.

Given the CVSS 9.8 score, the nature of the vulnerability as a regression of an already exploited defect class, and the documented scanning, upgrading GeoServer to the fixed versions should be a priority task. Organizations that cannot update within the next few hours should at minimum isolate vulnerable instances from direct internet access.