EUVD-2026-54479
GHSA-7c9q-38r9-q62m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-accessible with no privileges on Hyrax required; UI:R reflects user-triggered fetch; C:H for bearer-equivalent Earthdata credential leakage; no integrity or availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.
AnalysisAI
Unvalidated HTTP redirect handling in OPeNDAP Hyrax Docker 1.18.0 enables SSRF-assisted credential exfiltration, leaking Earthdata authentication headers (User-Id, Echo-Token) to attacker-controlled endpoints. The AllowedHosts allowlist - intended to restrict outbound server-side requests - is silently bypassed when Hyrax follows HTTP redirects without re-validating the destination against the allowlist, causing sensitive Earthdata Login (EDL) session headers to be forwarded externally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Hyrax be deployed with NASA Earthdata Login (EDL) integration active - specifically, the configuration that causes Hyrax to inject User-Id and Echo-Token headers into outbound HTTP data-fetch requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-accessible, low-complexity attack with no privilege requirement on Hyrax itself, but requiring user interaction - likely a user or automated client triggering a data request to an attacker-influenced URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the CERT/CC advisory at https://www.kb.cert.org/vuls/id/305509 for authoritative remediation guidance, as it is the primary coordinated disclosure source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today