GeoServer: an unauthenticated SQL injection in the jsonArrayContains filter is being exploited with no CVE and no patch — and NCSC-CH has put it in front of Swiss operators
A security researcher publicly disclosed an unauthenticated SQL-injection flaw in GeoServer on 2026-08-12, and attackers began probing for it the same day. The defect sits in jsonArrayContains, an OGC filter expression used to test whether a JSON array field contains a given value; user-supplied filter arguments reach the backend database query without adequate sanitisation, letting an unauthenticated caller alter the query's logic. The reporting states the function can be used with PostGIS and Oracle JDBC data stores (SecurityWeek, 2026-08-14), and Switzerland's NCSC records the prerequisite as "Network access to an exposed GeoServer instance configured with PostGIS or Oracle JDBC data stores" (NCSC-CH, 2026-08-14). watchTowr's Jake Knott told SecurityWeek the firm began seeing exploitation attempts within hours of disclosure and has since recorded hundreds of them from a small number of source addresses (SecurityWeek, 2026-08-14); Field Effect separately published on early exploitation attempts against the flaw on 2026-08-13, and states the observed activity consisted primarily of scanning and probing for vulnerable systems with no confirmed compromises described in public reporting as of that date (Field Effect, 2026-08-13). Knott puts it the same way to The Hacker News: attackers are probing to identify vulnerable systems, triggering errors and not proceeding further (The Hacker News, 2026-08-13). That distinction matters for triage — this is mass reconnaissance against an unpatchable exposure, not yet a wave of confirmed intrusions, and the window to reduce exposure is still open.
Two things make this worse than its missing CVE suggests. There is no identifier, so a purely CVE-driven patch process, scanner feed or SBOM pipeline will not surface it at all — the same blind spot this pipeline recorded on the Metabase zero-day six days ago. And there is no fix: NCSC-CH's advisory states plainly that no patch is currently available and tells operators to identify exposed instances, restrict public access and monitor for exploitation (NCSC-CH, 2026-08-14). Escalation beyond data theft depends on the database account's privilege: The Hacker News quotes Knott saying the flaw could ultimately lead to remote code execution, and reports the researcher's claim that an administrator-level database account makes code execution achievable (The Hacker News, 2026-08-13). Knott also notes GeoServer's history of being targeted at scale, with multiple GeoServer flaws already in CISA's Known Exploited Vulnerabilities catalog (SecurityWeek, 2026-08-14).
The relevance to this constituency is the deployment pattern rather than a named victim: GeoServer is a standard component of government geoportals and INSPIRE-directive spatial-data infrastructure — cantonal and municipal GIS, land-registry and environmental-agency mapping services — and SecurityWeek notes it is used across government, agriculture, telecoms and transit (SecurityWeek, 2026-08-14). No Swiss or EU victim has been named publicly. Detection concepts, telemetry class first: in web-access telemetry for the GeoServer front end and any reverse proxy ahead of it, surface requests whose OGC Filter or CQL expressions carry jsonArrayContains arguments containing SQL metacharacters, quote characters or stacked-query syntax rather than well-formed JSON values; in database telemetry, watch for query-syntax errors and unexpected statement shapes issued under the GeoServer service account, since early probing tends to surface as malformed queries before it succeeds; in process-execution telemetry with parent lineage, any child process spawned by the Java servlet container hosting GeoServer is a strong post-exploitation signal, because GeoServer has no legitimate reason to spawn one.
Triage: legitimate GIS clients construct jsonArrayContains filters routinely, so the presence of the function in a request is not the signal. The discriminators are the argument's shape — quote characters, SQL keywords or stacked statements where a JSON value belongs — and the pairing of such a request with a database error or an anomalous query from the GeoServer service account moments later.
Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses.
Successful exploitation could allow attackers to achieve remote code execution on affected GeoServer instances via improperly sanitized user-supplied input.
No patch is currently available; organizations should monitor for a vendor fix.
Defender actions
- Inventory internet-reachable GeoServer instances and take their WFS/WMS/WCS query endpoints off the public internet or behind authenticated access until OSGeo ships a fix — there is no patch to apply, so exposure reduction is the whole remediation. Cover every backend the reporting names, not just one: NCSC-CH records PostGIS and Oracle JDBC data stores as the reachable configuration, while Field Effect tells operators to include H2-backed deployments, where it locates the path to code execution.
ATT&CK mapping
1 technique mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.