CVE-2026-16637

Description

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

References

https://www.opendap.org/official-hyrax-1-18-release/

https://www.kb.cert.org/vuls/id/305509

https://github.com/OPENDAP/hyrax-docker

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3