Earthdata Search CVE-2026-82802

No authentication is required (CVSS 4.0 PR:N) and no user interaction is needed (UI:N). The sole condition is network reachability of the granules endpoint and the ability to supply the openSearchOsdd parameter with an attacker-controlled URL - both satisfied by a standard unauthenticated HTTP request against a publicly accessible deployment. No non-default configuration or special platform requirement is described. Exploitation is bounded in direct impact by the outbound network access of the Lambda function and the permissions attached to its IAM execution role; if the Lambda has no access to private network resources and IMDSv2 is enforced, practical damage is reduced. Integrity and availability are not directly affected per the CVSS 4.0 assessment (VI:N, VA:N).

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is remotely exploitable with no authentication and no special attack requirements, placing it among the most accessible SSRF classes. The E:P metric in the provided CVSS 4.0 vector confirms a public proof-of-concept has been released, which materially increases exploitation likelihood beyond base-score-only estimates. EPSS data was not provided in the input, so a quantified exploitation probability cannot be stated. The vulnerability is not listed in the CISA KEV catalog, meaning active widespread exploitation has not been confirmed - however, the published PoC lowers the skill barrier substantially, and a SSRF in a serverless Lambda deployment carries elevated secondary risk because cloud metadata credential theft could enable lateral movement within the AWS account. The CVSS 4.0 confidentiality rating (VC:L) may understate realistic impact if the Lambda's IAM role is over-provisioned. No KEV listing and no vendor response leave defenders without an authoritative patch or remediation timeline; even a small research-oriented deployment team should prioritize compensating controls promptly given the unauthenticated network exposure and public exploit code.

An unauthenticated attacker sends an HTTP request to the Earthdata Search granules endpoint with the openSearchOsdd parameter set to http://169.254.169.254/latest/meta-data/iam/security-credentials/, causing the Lambda function to fetch AWS instance metadata and return IAM role credentials in the response. A public proof-of-concept demonstrating this request structure has been published on GitHub, meaning exploitation requires no specialized knowledge of the application internals.