CVE-2026-70620

Received Received - Intake

Server-Side Request Forgery in Odysseus

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70620

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in Odysseus before commit 87babb5. It allows attackers with admin privileges to make the server send requests to internal network resources by submitting arbitrary URLs without proper validation. Attackers can use loopback addresses, private IP ranges, or link-local addresses to read responses from internal services like cloud metadata or APIs.

Detection Guidance

Detecting this SSRF vulnerability requires checking for improper URL validation in the Odysseus server. Monitor network traffic for outbound requests to internal or unexpected addresses from the server. Inspect API logs for embedding endpoint configurations with arbitrary URLs lacking proper scheme, host, or IP validation. Test by submitting loopback, RFC 1918, or link-local addresses to the embedding endpoint to observe if responses are read from internal services.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive internal network resources, potentially exposing confidential data or internal service details. It may enable unauthorized network probing, leading to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. It may result in data breaches, unauthorized disclosure, or failure to protect personal or health information.

Mitigation Strategies

Update Odysseus to the latest commit (87babb5 or later) to address the SSRF vulnerability. Validate and restrict URLs in the embedding endpoint configuration to prevent access to internal resources or loopback addresses.

Hi! I’m here to help you understand CVE-2026-70620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70