EUVD-2026-68578
GHSA-x7vq-m9h7-j2wv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint (AV:N/PR:N/UI:N); scope changes because SSRF reaches internal systems (S:C); confidentiality impact only as no write path confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the scaleImage function within serverless/src/scaleImage/handler.js, where user-supplied URL parameters are passed to the server without sufficient validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required; the scaleImage endpoint is publicly accessible without credentials as confirmed by the POC repository title 'Unauthenticated Scale Image SSRF' and the CVSS 4.0 PR:N metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this at network-reachable, zero-friction exploitation with no authentication barrier, consistent with the POC repository title 'Unauthenticated Scale Image SSRF.' The assigned 4.0 score of 5.5 reflects bounded CIA impact (VC:L/VI:L/VA:L), but this likely underestimates real-world risk in the specific cloud-serverless deployment context: successful SSRF against an AWS Lambda function could yield cloud credential exfiltration via IMDS, substantially elevating effective severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; NASA did not respond to the researcher's disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Earthdata Search
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today