CVE-2026-16637
OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.
| Vendor | opendap inc. |
| Product | hyrax-docker |
| Published | Aug 7, 2026 |
| Last Updated | Aug 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for opendap inc. hyrax-docker
Be the first to know when new unknown vulnerabilities affecting opendap inc. hyrax-docker are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
OPeNDAP Inc. / hyrax-docker
1.18.0