VulnSocial

CVE-2026-16637Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-201CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-08-07)
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-29: 1Mentions · 2026-08-07: 2Patch / Workaround · 2026-07-29: 1Technical Details · 2026-07-29: 1Technical Details · 2026-08-07: 207-2908-07
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-291
Disclosure1
2026-08-072
Disclosure2
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-16637 OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-To… https://www.cve.org/CVERecord?id=CVE-2026-16637 ----- Traducción: CVE-2026-16637 OPe… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-16637, detailing SSRF and credential leakage via unvalidated redirects in OPeNDAP Hyrax and provides a link to the CVE record.

    0000033
    98 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-16637 OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-To… https://www.cve.org/CVERecord?id=CVE-2026-16637

    Post summary

    The post details CVE-2026-16637, outlining an SSRF vulnerability in OPeNDAP Hyrax that leaks Earthdata credentials through unvalidated redirects; no PoC, exploit, or mitigation are mentioned.

    000001.1K
    57.9K followersView on X
  • OJOBIT@0J0BIT
    Disclosure

    that's reasonable for an open-source data server that remotes into scientific datasets (NetCDF, HDF, GrADS) > an unvalidated HTTP redirect flaw in OPeNDAP Hyrax (CVE-2026-16637) lets attackers bypass the AllowedHosts allowlist and steal Earthdata User-Id and Echo-Token > no patch yet; administrators should restrict gateway access to trusted networks until Hyrax-1.18.0 > CVE-2026-16637 is a server-side request forgery in OPeNDAP Hyrax that doesn't check the destination of HTTP redirects against the AllowedHosts allowlist-leaking > as of the 2026-07-29 public disclosure, no patch exists > OPeNDAP is working on a fix that will likely ship in Hyrax-1.18.0 > a missing redirect validation in OPeNDAP Hyrax lets attackers bypass the allowed hosts list and steal legacy Echo-Token credentials https://news.ojobit.com/story/opendap-hyrax-ssrf-credential-leak-32fc80

    Post summary

    CVE‑2026‑16637 is a server‑side request forgery in OPeNDAP Hyrax that allows attackers to bypass the AllowedHosts allowlist and steal credentials; no patch exists yet, but administrators are advised to limit network access until Hyrax‑1.18.0 and a fix is expected.

    0000039
    8 followersView on X

Explore more

Back to dashboard