CVE-2026-70620

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-70620

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70620.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-70620

Published

2026-08-04T21:16:32.449Z

Modified

2026-08-07T03:30:40.894203836Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

Odysseus SSRF via Embedding Endpoint Configuration

Details

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

Database specific

{
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "87babb58d57897089b133b313e2ab6d09e7ef54e"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70620.json",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/odysseus-dev/odysseus

Affected ranges

Type

GIT

Repo

https://github.com/odysseus-dev/odysseus

Events

Introduced

Fixed

87babb58d57897089b133b313e2ab6d09e7ef54e

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70620.json"