Unauthenticated SQL Injection in GeoTools PostGIS jsonArrayContains Filter (CVE-2026-76904)

What Happened

GitHub Security Advisory GHSA-mqjf-5f49-2fjh, published August 21, 2026, discloses a SQL injection vulnerability (CVE-2026-76904, CVSS 9.8) in GeoTools' PostGIS DataStore implementation. According to the advisory, the jsonArrayContains(<column>, <pointer>, <value>) OGC Filter function — usable against PostGIS 12 and later when the target column is a String or JSON field — writes the supplied <value> argument directly into generated SQL without escaping. The affected package is org.geotools.jdbc:gt-jdbc-postgis. A public proof of concept is noted as available. Patched versions are GeoTools 35.1, 34.4, and 33.5.

Why It Matters

GeoTools underpins numerous open-source and commercial GIS platforms (including GeoServer-based stacks) that expose OGC Filter query capability to end users or client applications. An unauthenticated, unescaped SQL injection reachable through a standard filter function means any service that evaluates attacker-supplied OGC filters against a PostGIS-backed layer using this function could allow arbitrary SQL execution against the database — potentially exposing or modifying data well beyond the mapped GIS layer, depending on database permissions.

What Defenders Should Do Now

• Identify any service using org.geotools.jdbc:gt-jdbc-postgis (directly or via GeoServer/other GeoTools-based applications) and upgrade to GeoTools 35.1, 34.4, or 33.5.
• The advisory states no mitigation is available short of patching; as a compensating control, restrict the PostGIS connection pool's database rights to the minimum required, limiting blast radius if the injection is exploited.
• Review logs and WAF/API gateway rules for OGC Filter requests referencing jsonArrayContains, especially those with anomalous or SQL-like payloads in the value argument.
• Audit which endpoints accept externally-supplied OGC filters and whether authentication/authorization is enforced before filter evaluation reaches the database layer.

Developing Intel

This is a same-day advisory and details may evolve as the community assesses real-world exposure and exploitation. For the authoritative technical details, patch links, and references, see the original GitHub Security Advisory: GHSA-mqjf-5f49-2fjh.