Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
Now tracked as CVE-2026-70619, CVE-2026-70620. Write-up: https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/
Post summary
New CVEs 2026-70619 and 2026-70620 have been identified, and a write-up detailing the vulnerability is available via the provided URL.
🚨*CVE* CVE-2026-70620 Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal netw… https://www.cve.org/CVERecord?id=CVE-2026-70620 ----- Traducción: CVE-2026-70620 Ody… http://infoflow.cloud`
Post summary
CVE-2026-70620 describes a server‑side request forgery in Odysseus that enables privileged attackers to probe internal networks; no PoC, exploit, or patch information is provided.
CVE-2026-70620 Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal netw… https://www.cve.org/CVERecord?id=CVE-2026-70620
Post summary
The post announces CVE‑2026‑70620 in Odysseus, detailing a server‑side request forgery that lets privileged admins probe internal networks; no exploitation tools or active use are mentioned.