CVE-2026-16637

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-16637

OPeNDAP Hyrax (CVE-2026-16637) is vulnerable to SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and may leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints. Concrete details across connected sources specify the affecte...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

Overview A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability...