SSRF in Odysseus-Dev Odysseus
CVE-2026-70620
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.003 (18.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Odysseus-dev Odysseus — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-70620?
- CVE-2026-70620 is a medium-severity vulnerability in Odysseus-Dev Odysseus, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.8/10. Published 2026-08-04.
- How severe is CVE-2026-70620?
- Medium severity. CVSS v3 base score is 6.8 out of 10.