An unauthenticated Server-Side Request Forgery vulnerability in pygeoapi version 0.23.0 through 0.23.2 exposes internal infrastructure to unauthorized network access.

This is a Server-Side Request Forgery flaw, tracked as CWE-918, where OGC API process execution requests can leverage the subscriber object to target internal HTTP services. The attack vector is network-based and requires no authentication.

A successful exploit allows malicious actors to pivot from the public-facing server into internal network segments, potentially compromising internal services, sensitive metadata, or backend databases that are not exposed to the public internet. This high CVSS score of 8.6 reflects the severity of allowing remote unauthenticated attackers to bypass network perimeters and access restricted internal resources.

Immediate Action: Update pygeoapi to version 0.23.3 or later as provided in the official vendor advisory and package repositories.

Proactive Monitoring: Monitor server access logs for unusual outbound requests originating from the pygeoapi host toward internal IP addresses or reserved network ranges.

Compensating Controls: Implement strict egress filtering and network segmentation policies on the host running pygeoapi to block outbound connections to internal network segments.

Public Exploit Available: No (no confirmed public exploit or weaponized module identified in the available data).

Organizations running pygeoapi versions 0.23.0 through 0.23.2 face significant exposure to internal network reconnaissance and data compromise via Server-Side Request Forgery. Administrators must prioritize applying the update to version 0.23.3 immediately to eliminate the underlying flaw and secure internal infrastructure.