Detections
Analytics

SCA: security update for @geolens/sdk, geolens, geolens-cli (GHSA-p23g-mvhj-jh3j)

high Tenable Self-Hosted Container Security Plugin ID 446058

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map
 builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request
 URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer,
 VRT source, externalId lookup, or request body. When a public map references a private dataset, anonymous
 callers can use GET /maps/{id} and GET /maps/{id}/style.json to obtain the private layer's metadata,
 sampled values, or vector tiles. The style response can expose a replayable HMAC tile URL that is bound to
 neither a user nor a map. When a public source dataset has a relationship to a private target dataset,
 anonymous callers can use the dataset relationship APIs to enumerate the relationship and read rows from
 the private target's backing table. Anonymous callers can also use GET /collections/datasets/items with an
 externalId dataset UUID to obtain metadata for any private, restricted, or unpublished dataset because
 that lookup performs no visibility check. Authenticated users with the default editor role can mosaic
 another user's private raster into an owned VRT and read its pixels, and POST
 /ai/metadata/{summary,keywords,lineage,quality-statement} accepts a body-controlled dataset_id without a
 visibility check and returns private metadata and sample values. Pre-existing vrt_source_links also expose
 unauthorized member metadata and health unless each member is filtered at read time. These paths can
 disclose vector geometries and attributes, raster pixels, table rows, table names, column schemas, feature
 counts, extents, source URLs and filenames, contacts, and sampled row values. This issue is fixed in
 version 1.2.3. (CVE-2026-55178)

Solution

Update the @geolens/sdk library and its related packages to version 1.2.3 or later.

See Also

https://github.com/advisories/GHSA-p23g-mvhj-jh3j

Plugin Details

Severity: High

ID: 446058

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 8/18/2026

Updated: 9/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.76

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-55178

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-55178