CVE-2026-70620 Details
Description
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
A server-side request forgery (SSRF) vulnerability has been identified in Odysseus versions prior to commit 87babb5. This vulnerability allows admin-privileged attackers to direct the server to probe internal network resources. The issue arises because the embedding endpoint configuration does not validate the scheme, host, IP range, or DNS rebind of user-supplied URLs. Attackers can exploit this by submitting loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API. This could lead to partial exfiltration of responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
Users can update to the latest version of Odysseus, where this vulnerability has been fixed. The patch includes adding proper authorization checks and validating the embedding endpoint URLs before making any outbound requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/ | [email protected] | ExploitTechnical Analysis |
| https://github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e | [email protected] | Source CodeVendor |
| https://github.com/odysseus-dev/odysseus/issues/132 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/odysseus-dev/odysseus/pull/1206 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/odysseus-ssrf-via-embedding-endpoint-configuration | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Odysseus | < 87babb58d57897089b133b313e2ab6d09e7ef54e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |