CVE-2026-16637 — OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects

CVE-2026-16637

OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects PUBLISHED

Description (CNA)

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

Affected (CNA)

Vendor / product	Versions
OPeNDAP Inc. / hyrax-docker	affected 1.18.0

CWE

No CWE identifiers supplied.

References

https://github.com/OPENDAP/hyrax-docker
https://www.opendap.org/official-hyrax-1-18-release/

ADP enrichment

CVE

No English description supplied.

https://www.kb.cert.org/vuls/id/305509

CISA-ADP

No English description supplied.

No references supplied.