EUVD-2026-54479
GHSA-7c9q-38r9-q62m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-accessible with no privileges on Hyrax required; UI:R reflects user-triggered fetch; C:H for bearer-equivalent Earthdata credential leakage; no integrity or availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.
AnalysisAI
Unvalidated HTTP redirect handling in OPeNDAP Hyrax Docker 1.18.0 enables SSRF-assisted credential exfiltration, leaking Earthdata authentication headers (User-Id, Echo-Token) to attacker-controlled endpoints. The AllowedHosts allowlist - intended to restrict outbound server-side requests - is silently bypassed when Hyrax follows HTTP redirects without re-validating the destination against the allowlist, causing sensitive Earthdata Login (EDL) session headers to be forwarded externally. No active exploitation has been confirmed (EPSS 0.21%, 11th percentile; not in CISA KEV), but the confidentiality impact is rated High due to the direct exposure of bearer-equivalent credentials used to access NASA/Earthdata scientific datasets.
Technical ContextAI
OPeNDAP Hyrax is a server-side implementation of the OPeNDAP/DAP protocol, commonly deployed in scientific and government data environments (NASA, NOAA, oceanographic institutions) to serve geospatial and atmospheric datasets. The Docker packaging (CPE: cpe:2.3:a:opendap_inc.:hyrax-docker:*:*:*:*:*:*:*:*) is the affected delivery mechanism. Hyrax integrates with NASA Earthdata Login (EDL), injecting session-scoped HTTP headers - User-Id and Echo-Token - into outbound data-fetch requests. CWE-201 (Insertion of Sensitive Information Into Sent Data) describes the root cause: the application propagates authentication headers across redirect hops without stripping them or re-evaluating the redirect target against the AllowedHosts security control. This is a classic SSRF-via-open-redirect pattern where the trusted-destination allowlist enforced at initial request time is not re-enforced at redirect time, allowing an attacker to route the credential-bearing request to an arbitrary endpoint.
RemediationAI
Consult the CERT/CC advisory at https://www.kb.cert.org/vuls/id/305509 for authoritative remediation guidance, as it is the primary coordinated disclosure source. Review the official Hyrax 1.18 release notes at https://www.opendap.org/official-hyrax-1-18-release/ for any patch or configuration guidance provided by OPeNDAP Inc. No exact fixed version number is independently confirmed in the available data; do not upgrade to an unspecified version without vendor confirmation. As a compensating control, configure network egress filtering at the infrastructure level to restrict Hyrax container outbound HTTP/HTTPS traffic to only known Earthdata and data source hostnames - this supplements (and compensates for the bypass of) the AllowedHosts allowlist. Additionally, consider disabling or rotating Echo-Token credentials for affected deployments and auditing outbound HTTP request logs for unexpected redirect destinations. Restricting the Earthdata EDL token scope to minimum necessary dataset access reduces the blast radius of any credential leak.
Share
External POC / Exploit Code
Leaving vuln.today