pygeoapi, a Python server implementation of the OGC API standards, contains an SSRF vulnerability (CWE-918) in versions from 0.23.0 to before 0.23.3. The vulnerability arises because the subscriber object in process execution requests can be manipulated to send HTTP requests to internal services, potentially exposing internal network resources. This vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is fixed in version 0.23.3.

Successful exploitation could allow an unauthenticated attacker to cause the server to make HTTP requests to internal services, potentially exposing sensitive internal information. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Upgrade pygeoapi to version 0.23.3 or later, where this SSRF vulnerability has been patched. Since the vendor advisory confirms the fix in 0.23.3, applying this official update is the recommended remediation. No other mitigation guidance is provided or necessary.