CVE-2026-70620

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/
https://github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e
https://github.com/odysseus-dev/odysseus/issues/132
https://github.com/odysseus-dev/odysseus/pull/1206
https://www.vulncheck.com/advisories/odysseus-ssrf-via-embedding-endpoint-configuration

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Odysseus antes del commit 87babb5 contiene una vulnerabilidad de falsificación de petición del lado del servidor que permite a atacantes con privilegios de administrador dirigir el servidor para sondear recursos de red internos suministrando URLs arbitrarias a la configuración del punto final de incrustación sin validación de esquema, host, rango de IP o rebind de DNS. Los atacantes pueden enviar direcciones de bucle invertido, rangos RFC 1918 o direcciones de enlace local a través de la API del punto final de incrustación para leer parcialmente respuestas de servicios de metadatos de instancias en la nube, APIs internas y otros hosts accesibles desde el servidor.

Information

Published : 2026-08-04 22:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-70620

Mitre link : CVE-2026-70620

CVE.ORG link : CVE-2026-70620

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-70620", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70620", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T14:16:42.703887Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/odysseus-dev/odysseus", "vendor": "odysseus-dev", "product": "odysseus", "versions": [{"status": "affected", "version": "0", "lessThan": "87babb58d57897089b133b313e2ab6d09e7ef54e", "versionType": "git"}], "packageURL": "pkg:github/odysseus-dev/odysseus", "defaultStatus": "affected"}]}], "published": "2026-08-04T22:17:17.727", "references": [{"url": "https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/odysseus-dev/odysseus/issues/132", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/odysseus-dev/odysseus/pull/1206", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/odysseus-ssrf-via-embedding-endpoint-configuration", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server."}, {"lang": "es", "value": "Odysseus antes del commit 87babb5 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor que permite a atacantes con privilegios de administrador dirigir el servidor para sondear recursos de red internos suministrando URLs arbitrarias a la configuraci\u00f3n del punto final de incrustaci\u00f3n sin validaci\u00f3n de esquema, host, rango de IP o rebind de DNS. Los atacantes pueden enviar direcciones de bucle invertido, rangos RFC 1918 o direcciones de enlace local a trav\u00e9s de la API del punto final de incrustaci\u00f3n para leer parcialmente respuestas de servicios de metadatos de instancias en la nube, APIs internas y otros hosts accesibles desde el servidor."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}