A newly disclosed SQL injection vulnerability in GeoServer, the widely used open-source platform for sharing and editing geospatial data, is being actively exploited within hours of its public disclosure, according to security researchers.
The flaw resides in GeoServer’s jsonArrayContains function and can lead to unauthorized SQL injection. Researchers say that under certain database configurations — specifically when GeoServer is running against an sa (system administrator) database account — the vulnerability can be escalated to remote code execution (RCE).
Security researcher @q1uf3ng disclosed the issue publicly on X on August 12, 2026, at 10:46 UTC. No CVE identifier has been assigned to the vulnerability as of this writing, and no official patch is currently available from the GeoServer project.
Threat intelligence firm watchTowr reported observing exploitation attempts “within hours of public disclosure,” originating from a limited pool of IP addresses. Jake Knott, principal security researcher at watchTowr, said: “Currently, we’re seeing attackers probe to identify vulnerable systems across the internet, triggering errors and not proceeding further” — indicating early-stage scanning and reconnaissance rather than confirmed successful compromise at this time.
Recommended actions
- Identify any internet-facing GeoServer instances in your environment.
- Restrict public access to GeoServer where possible until a patch is released.
- Monitor logs for anomalous requests to the
jsonArrayContainsfunction. - Watch for an official advisory and patch from the GeoServer project and apply it promptly once available.
Source: The Hacker News, August 13, 2026.
