EUVD-2026-52931
GHSA-pp2c-7vpq-xf5f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin auth required (PR:H); no vulnerable-system CIA impact; scope changes to reach subsequent systems (cloud metadata) with high confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
AnalysisAI
Server-side request forgery in Odysseus before commit 87babb5 allows admin-authenticated attackers to weaponize the embedding endpoint configuration API to probe internal network resources, including cloud instance metadata services at 169.254.169.254, RFC 1918 hosts, and other server-reachable targets. The vulnerability arises because the embedding endpoint accepted arbitrary URLs without validating scheme, host, IP range, or DNS rebinding protections, enabling partial response exfiltration from cloud credential endpoints and internal APIs. A publicly available exploit and blog post exist; the vulnerability is not currently listed in CISA KEV, but the high subsequent-system confidentiality impact (SC:H in the provided CVSS 4.0 vector) reflects real risk of cloud credential theft from metadata services.
Technical ContextAI
Odysseus is a local-first, self-hosted AI assistant application that supports configurable custom embedding endpoints (e.g., pointing to local vLLM, llama.cpp, or Ollama servers). The vulnerable route - POST /api/embeddings/endpoint in routes/embedding_routes.py - accepted a user-supplied URL parameter and used it to make outbound HTTP requests without validating the destination. CWE-918 (Server-Side Request Forgery) applies: the server acts as an unwitting HTTP proxy on behalf of the authenticated attacker. Because Odysseus is intentionally designed to contact local addresses for embedding servers, there was no blanket block on private IP ranges, but the fix differentiates legitimate local embedding use from SSRF vectors by always rejecting link-local ranges (169.254.0.0/16, fe80::/10 - the cloud metadata SSRF vector), non-HTTP(S) schemes, and multicast/reserved/unspecified addresses. A new EMBEDDING_BLOCK_PRIVATE_IPS=true environment variable enables full private-IP lockdown for multi-tenant deployments. CPE: cpe:2.3:a:odysseus-dev:odysseus:*:*:*:*:*:*:*:*.
RemediationAI
The upstream fix is available at commit 87babb58d57897089b133b313e2ab6d09e7ef54e (https://github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e) via PR #1206 (https://github.com/odysseus-dev/odysseus/pull/1206); operators should update to a build containing this commit immediately. The patch introduces a new url_safety.py module that always blocks non-HTTP(S) schemes, link-local addresses (169.254.0.0/16), multicast, reserved, and unspecified addresses, covering the cloud metadata credential-theft vector without breaking the intended local embedding server use case. For deployments where Odysseus is exposed to multiple users or is cloud-hosted, set the EMBEDDING_BLOCK_PRIVATE_IPS=true environment variable to enable full lockdown of all private and loopback ranges - note this will prevent pointing the embedding endpoint at any local vLLM, Ollama, or llama.cpp server, which is the product's primary intended use. As a compensating control prior to patching, restrict access to the admin interface via network ACLs or reverse proxy authentication so that only fully trusted operators can reach the embedding endpoint configuration API. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/odysseus-ssrf-via-embedding-endpoint-configuration for further guidance.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today