CVE-2026-70619

Received Received - Intake

Authenticated Non-Admin Access Leading to Embedding Backend Misconfiguration in Odysseus

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers can supply an attacker-controlled URL to overwrite the embedding backend persisted in the endpoint configuration file and process environment, causing all subsequent embedding operations including chat messages, RAG queries, memory entries, and vault text to be transmitted in plaintext to the attacker-controlled destination, or delete the endpoint configuration to deny embedding service to all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70619

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Odysseus before commit bf325f6 allows authenticated non-admin users to manage server-wide embedding backend configuration without proper admin authorization. Attackers can exploit this by providing a malicious URL to overwrite the embedding backend settings, causing sensitive data like chat messages and RAG queries to be sent in plaintext to attacker-controlled destinations or disabling embedding services entirely.

Detection Guidance

Check for unauthorized modifications to embedding backend configuration files or environment variables. Review server logs for requests to management endpoints by non-admin users. Look for plaintext transmission of sensitive data to unexpected destinations.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data transmitted via embedding operations, such as chat messages or memory entries. Attackers might intercept or manipulate this data, or disrupt embedding services for all users, causing data leaks or service unavailability.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by exposing sensitive data in plaintext during transmission. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update Odysseus to commit bf325f6 or later to apply the missing authorization fix. Restrict access to management endpoints to admin users only. Audit configuration files and environment variables for unauthorized changes. Monitor network traffic for plaintext data transmission to unknown destinations.

Hi! I’m here to help you understand CVE-2026-70619. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70