CVE-2026-76904 is a critical-severity (CVSS 9.8) SQL Injection vulnerability in org.geotools.jdbc:gt-jdbc-postgis. 1 public exploit reference exists, so weaponization risk is real. A fix is available for org.geotools.jdbc:gt-jdbc-postgis — see the affected versions and patch details below.
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-76904.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-76904 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 382,795 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
org.geotools.jdbc:gt-jdbc-postgis☕org.geotools.jdbc:gt-jdbc-postgis☕org.geotools.jdbc:gt-jdbc-postgisReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
jsonArrayContainsfunction
Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.
Patches
- GeoTools 35.1
- GeoTools 33.5
- GeoTools 34.4
Mitigation
No mitigation is available:
- To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Impact
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.geotools.jdbc:gt-jdbc-postgis | ≥ 35.0&&< 35.1 | 35.1org.geotools.jdbc:gt-jdbc-postgis:35.1 |
| ☕Maven | org.geotools.jdbc:gt-jdbc-postgis | ≥ 34.0&&< 34.5 | 34.5org.geotools.jdbc:gt-jdbc-postgis:34.5 |
| ☕Maven | org.geotools.jdbc:gt-jdbc-postgis | ≥ 30.5&&< 33.6 | 33.6org.geotools.jdbc:gt-jdbc-postgis:33.6 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.geotools.jdbc:gt-jdbc-postgis, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.geotools.jdbc:gt-jdbc-postgis to 35.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-76904 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.
How to detect CVE-2026-76904
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2026-76904 -u https://target- Template
- GeoServer jsonArrayContains CQL Filter - SQL Injection
- Severity
- critical
- Impact
- Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.
- Remediation
- Upgrade GeoServer to version 2.21.4 or 2.22.2 or later. As an interim workaround, enable the PostGIS DataStore preparedStatements setting to prevent stacked-query abuse and disable encode functions to limit CQL filter function misuse.
Template by ProjectDiscovery nuclei-templates (portbuster1337, DhiyaneshDk), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2026-76904 in your dependencies?
Find it across Maven, including transitive dependencies.