CVE-2026-86806 is a high severity server-side request forgery in opengeos GeoLibre up to version 2.3.0. The weakness sits in the _is_within_roots function and can be triggered remotely. The record recommends upgrading to GeoLibre 2.4.0, which includes the fix commit b745f62.
What's affected
Affected: opengeos GeoLibre up to and including 2.3.0, according to the record. The recommended version is 2.4.0, and the record cites patch commit b745f62e29fa37364686525a21eee5e5c0f8a369, pull request 1571 and the v2.4.0 release.
The record gives CVSS 3.1 at 7.3 (High). I found no second score. There is a source difference to note. The linked issue number 1573, filed by a reporter and labeled unconfirmed, lists the version field as v2.4.0 and a different weakness number (CWE-22), while the record says up to 2.3.0 and CWE-918. I could not confirm which is accurate from the pages I read, so check the release notes for 2.4.0 before relying on it. Nothing I read reports exploitation, and the CVE is not in CISA KEV.
How to check if you're exposed
Find the GeoLibre version you run. For the desktop and web apps, the About screen or the release page shows it. For a source checkout run:
git describe --tags
For the Python package, check what pip reports for the installed package. Anything at or below 2.3.0 is in range per the record.
The issue describes the FastAPI sidecar, a backend server that GeoLibre runs next to the app. Check whether that sidecar is running on a network interface other than localhost, since remote reachability is what turns an SSRF into a risk. If it only listens on your own machine, exposure is much smaller.
What to do now
- Find every place GeoLibre runs, including desktop installs, server deployments and containers.
- Upgrade to 2.4.0 or later and read the release notes for the security changes.
- Bind the sidecar to localhost, or put it behind authentication, if it must run on a server.
- Restrict outbound network access from the host so the server can only reach the databases and services it needs.
- Review logs for unexpected outbound connections from the sidecar process.
Why it matters
Server-side request forgery (CWE-918) means the server can be talked into making a request on an attacker's behalf, to a place the attacker cannot reach directly. Typical targets are internal services and cloud metadata addresses.
The record names _is_within_roots, a function that decides whether a target falls within allowed roots. When a check like that is wrong or missing, a path or address the application meant to refuse is accepted. The related issue describes endpoints that accept a raw database connection string from the client and pass it to the database driver without host validation, though that issue is a user report and I could not confirm how it maps to the final fix.
The general lesson holds: any feature that makes a network or file request from user input needs an allow list, checked after the address is resolved, and outbound network controls as a backstop.
Quick check
Which version fixes it?
The record recommends 2.4.0. Verify with the project release notes, because the linked issue lists 2.4.0 as the reporter's version.
Is a local desktop install at risk?
Much less than a server. The risk depends on whether the backend sidecar is reachable by other machines.
Sources
- Fix commit b745f62 in opengeos/GeoLibre
- GeoLibre issue 1573
- GeoLibre repository
- Safeguard Gold entry for CVE-2026-86806
Last reviewed: 18 October 2026.
