Inside the GeoServer Zero-Day: From jsonArrayContains to Potential RCE

Summary

GeoServer is affected by a critical unauthenticated SQL injection vulnerability in the jsonArrayContains filter function. The vulnerability was publicly disclosed as a zero-day on August 12, 2026, and security researchers observed probing activity against potentially vulnerable GeoServer instances shortly after disclosure. The vulnerability affects the GeoServer/GeoTools database stack when the affected PostGIS functionality is used, particularly with PostGIS 12 or later and relevant String/Text or JSON columns.

The vulnerability allows a remote attacker to supply specially crafted input through an OGC filter request that reaches the vulnerable jsonArrayContains functionality. Due to improper handling of attacker-controlled input during SQL query generation, the input can be incorporated into a database query in an unsafe manner. Successful exploitation can allow an unauthenticated attacker to perform unauthorized SQL operations against the backend PostgreSQL/PostGIS database. The ultimate impact depends on the privileges assigned to the database account used by GeoServer. In configurations where the database account has excessive privileges or capabilities that permit operating-system interaction, exploitation may potentially lead to remote code execution.

The vulnerability is particularly significant because GeoServer is commonly deployed as an Internet-facing application for publishing and managing geospatial information. Security researchers observed attackers probing potentially vulnerable systems within hours of public disclosure. The initial reports described the issue as an unpatched zero-day; however, GeoServer subsequently released security updates on August 14, 2026. Organizations operating affected GeoServer installations should therefore prioritize upgrading to a fixed release, restricting unnecessary network exposure, reviewing database privileges, and investigating logs for exploitation attempts.

Vulnerability Details

SVE ID	Severity	CVSS Score	Vulnerability Type
SVE-110168	Critical	9.8	SQL Injection (Unauthenticated Remote SQL Injection)

SVE: SecPod Vulnerability Enumeration.

The vulnerability is identified by GHSA-mqjf-5f49-2fjh and has been rated CVSS 9.8 (Critical). At the time of the initial public disclosure, a CVE identifier had not been assigned. The vulnerability affects the jsonArrayContains filter functionality in the GeoServer/GeoTools database stack and can be reached remotely without requiring an attacker to authenticate first.

The vulnerable functionality is associated with the GeoTools gt-jdbc-postgis component. The current affected conditions involve GeoServer deployments using PostGIS 12 or later with relevant String/Text or JSON columns. Successful exploitation can allow attacker-controlled input to influence SQL statements executed by the backend database. The resulting impact depends on the permissions and capabilities available to the database account used by GeoServer.

Technical Detail

The root cause of the vulnerability is improper handling of attacker-controlled input in the jsonArrayContains filter function. GeoServer uses GeoTools to process OGC filter expressions and translate them into database-specific queries. When the affected functionality is used against a vulnerable PostGIS data store, input supplied through the filter can reach the SQL generation process without being handled safely.

The attack can be represented as Attacker → GeoServer → OGC filter → jsonArrayContains() → GeoTools → PostgreSQL/PostGIS. An unauthenticated remote attacker can send a specially crafted request containing malicious filter input. GeoServer processes the request and invokes the vulnerable function, which can result in attacker-controlled data being incorporated into the generated SQL query. The database subsequently processes the resulting query.

The vulnerability should primarily be classified as SQL injection rather than automatically being classified as remote code execution. Successful SQL injection can provide unauthorized interaction with the backend database, including potentially reading or modifying accessible information and invoking database functionality permitted to the GeoServer database account. If the database account has excessive privileges or the underlying database configuration provides capabilities that allow operating-system interaction, exploitation may potentially progress to remote code execution.

The database privileges assigned to GeoServer therefore have a significant effect on the potential impact. A dedicated low-privileged database account can limit what an attacker can accomplish after successful SQL injection, whereas a highly privileged account can substantially increase the potential consequences. The vulnerability has also been described as a regression of an earlier GeoServer SQL injection vulnerability, highlighting the importance of security regression testing when database query functionality is changed.

Security researchers observed probing activity shortly after the vulnerability was publicly disclosed. Attackers were observed testing potentially vulnerable GeoServer installations, demonstrating that publicly exposed systems could be targeted rapidly. Organizations should therefore review GeoServer HTTP logs, OGC filter requests, database errors, unusual database queries, unexpected outbound connections, and other indicators of compromise around and after the public disclosure date.

Affected Versions

GeoServer Version Branch	Fixed Version
GeoServer 3.0.x	3.0.1
GeoServer 2.28.x	2.28.5
GeoServer 2.27.x	2.27.6

The vulnerability is associated with the GeoTools gt-jdbc-postgis component. Reported fixed versions for the affected GeoTools branches include 35.1 for the 35.x branch, 34.5 for the 34.x branch, and 33.6 for the 33.x branch.

The affected configuration involves GeoServer deployments using the vulnerable PostGIS functionality, particularly PostGIS 12 or later with relevant String/Text or JSON columns. Organizations should therefore assess both the GeoServer version and the underlying database configuration rather than relying solely on the product version.

Note: The initial security reports described the issue as an unpatched zero-day because no vendor fix was available at the time of public disclosure. GeoServer subsequently released security updates on August 14, 2026. Organizations should upgrade to the appropriate fixed release rather than treating the vulnerability as currently unpatched.

Impact

Successful exploitation can allow an unauthenticated remote attacker to perform unauthorized SQL operations against the database used by a vulnerable GeoServer deployment. The severity of the resulting compromise depends largely on the privileges assigned to the GeoServer database account and the configuration of the underlying PostgreSQL/PostGIS environment.

1. 1. Unauthenticated remote exploitation of an exposed GeoServer installation
2. 2. Unauthorized interaction with the PostgreSQL/PostGIS database through SQL injection
3. 3. Potential unauthorized reading, modification, or manipulation of database information permitted by the GeoServer database account
4. 4. Potential exposure of sensitive geospatial and application data stored in the backend database
5. 5. Potential escalation from database compromise to remote code execution under certain database privilege and configuration conditions
6. 6. Potential use of a compromised GeoServer host as an initial foothold for further attacks against connected infrastructure

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access (TA0001)
T1213.006	Data from Information Repositories: Databases	Collection (TA0009)

Mitigation

1. 1. Upgrade GeoServer to the appropriate fixed release: 3.0.1, 2.28.5, or 2.27.6, depending on the deployed branch. Also update the associated GeoTools components to the security-fixed versions: 35.1, 34.5, or 33.6 for the affected branches.
2. 2. If immediate patching is not possible, restrict access to GeoServer using firewalls, VPNs, IP allowlists, or reverse proxies, and avoid exposing the service directly to the public Internet where it is not required.
3. 3. Review the PostgreSQL/PostGIS account used by GeoServer and ensure it follows the principle of least privilege. Avoid using highly privileged or administrative database accounts.
4. 4. Review GeoServer and PostgreSQL/PostGIS logs for suspicious OGC filter requests, unusual SQL queries or errors, unauthorized data access, and other signs of exploitation.
5. 5. If exploitation is suspected, investigate the GeoServer host and backend database, rotate potentially exposed database credentials, and review network activity for signs of post-exploitation.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.