The vulnerability resides in pygeoapi’s OGC API process execution endpoint, where an unauthenticated subscriber object can be supplied. Because the server forwards the subscriber URL to an internal HTTP service without validation, an attacker can cause the server to perform arbitrary network requests, exposing internal resources or executing code on internal targets. This constitutes a Server Side Request Forgery (CWE‑918) that could compromise confidentiality and integrity of internal services.

Affected customers are those running geopython's pygeoapi between versions 0.23.0 and 0.23.2, inclusive, which is before the patch release 0.23.3. The vulnerability applies to all installations of this product, regardless of deployment environment, as no authentication is required to trigger the flaw.

The CVSS score of 8.6 marks this as high severity, and EPSS data is not available, so the exploitation probability cannot be quantified in the current dataset. The flaw is not listed in the CISA KEV catalog. Because the attack requires only normal HTTP requests to the OGC API endpoint and no special privileges, the likely attack vector is remote interaction over the network. An adversary can send crafted requests from anywhere with network reach to the exposed API, causing the server to reach internal hosts or services that would otherwise be restricted.