CVE-2026-55864 describes an SSRF vulnerability in GeoNetwork core-geonetwork's POST /api/tools/ogc/sld endpoint. The server accepted arbitrary WMS server URLs and performed server-side HTTP GET requests without validating the target destination. This allowed unauthenticated attackers to induce the server to send requests to internal hosts that are otherwise inaccessible externally. When the response was XML, the server stored and returned the response body, making the SSRF non-blind and enabling internal data disclosure, bypass of authorization controls, and network reconnaissance. The issue affects versions >=4.0.0 <4.2.17 and >=4.4.0 <4.4.12 and is resolved in 4.2.17 and 4.4.12.

An unauthenticated attacker can exploit this SSRF vulnerability to make the GeoNetwork server send HTTP requests to internal network hosts that are not publicly reachable. This can lead to unauthorized internal data disclosure, bypass of authorization mechanisms, and network reconnaissance activities. The ability to receive and return the fetched XML response increases the severity by enabling direct access to internal information.

This vulnerability is fixed in GeoNetwork core-geonetwork versions 4.2.17 and 4.4.12. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if these versions are deployed.