CVE-2026-70619 Details
Description
Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers can supply an attacker-controlled URL to overwrite the embedding backend persisted in the endpoint configuration file and process environment, causing all subsequent embedding operations including chat messages, RAG queries, memory entries, and vault text to be transmitted in plaintext to the attacker-controlled destination, or delete the endpoint configuration to deny embedding service to all users.
A missing authorization vulnerability has been identified in Odysseus, prior to commit bf325f6, allowing authenticated non-admin users to manipulate server-wide embedding backend settings. This issue arises because the relevant endpoint management routes authenticate sessions but fail to enforce admin privileges. Exploitation enables attackers to overwrite the embedding backend with a URL of their choice, leading to unauthorized data exfiltration of all user embedding activities, or to disrupt the embedding service entirely by deleting the endpoint configuration.
The vulnerability has been fixed by adding admin authorization to the embedding management routes. Users can update their Odysseus installation to the latest version, which includes this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/ | [email protected] | ExploitTechnical Analysis |
| https://github.com/odysseus-dev/odysseus/commit/bf325f6b2185cb42bc5d8f5713a64aecffb766d4 | [email protected] | Source CodeVendor |
| https://github.com/odysseus-dev/odysseus/issues/132 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/odysseus-dev/odysseus/issues/80 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/odysseus-missing-admin-authorization-via-embedding-endpoint-routes | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Odysseus | < bf325f6b2185cb42bc5d8f5713a64aecffb766d4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |