Hello,
Today, the Internet Storm Center’s Stormcast podcast mentions Geoserver, referring to an X post in Chinese. The X post refers to a gist which seems to have some Python code which purports to be an SQL injection exploit. I haven’t tried the code.
Does someone know, if this is real? And if so: Does any GeoServer release have a fix for it? And/or is there any known mitigation for it?
Yes it is real, I am about to share a post on that topic 
It is unfortunate that an depressed Chinese teenager can eat into everyone’s weekend / happiness.
If you or anyone you know is discouraged, or struggling with mental health, please reach out for support. Somehow I do not expect x.org to be a reliable source of compassion.
In case someone has not noticed already, releases are available for download: 3.0.1, 2.28.5, and 2.27.6:
Cheers
Andrea
Is the vulnerability only exploitable when one has a JSON column in the database? Or is it exploitable as soon as GeoServer has any Postgres data store?
The requirement is a PostgreSQL datastore version 12 or above. It’s a SQL injection if the user configured in the pool has limited rights (which should always be the case in a well managed installation), can turn into a RCE if the user has superuser powers or specific grants to execute the COPY TO “program” command (e.g., the “postgres” user has been configured in the postgis datastore connection, a dangerous setup in general).
Cheers
Andrea
We have a CVE-2026-76904 assigned for GeoTools.
I will update the geoserver website, and publishing the downstream security advisory, with specific instructions for GeoServer.
Thank you, Jody.
Okay the GeoServer CVE-2026-76904 advisory posted now posted.
This report is against org.geoserver.web:gs-app war so scans will detect installations of GeoServer specifically. The original geotools report provides the CVE number and is against org.geotools.jdbc:gt-jdbc-postgis jar.
The website release announcements are updated with new link.