Live › vulnerability › CVE-2026-46487
When a search request leaves out the query field, GeoNetwork's Elasticsearch search proxy forwards it without its access-control filters. An unauthenticated remote attacker can then read the full indexed contents of metadata records that should not be public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Any GeoNetwork instance in the affected version ranges whose Elasticsearch-backed public search API is reachable without authentication. Instances that restrict the search API to logged-in users or sit behind a network boundary are less exposed, but the sources do not say how much that reduces risk.
No product ranges from the sources yet.
4.2.16 on the 4.2 line.4.4.11 on the 4.4 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-46487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.