CVE-2026-82802
NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-918 |
| Vendor | nasa |
| Product | earthdata-search |
| Published | Aug 31, 2026 |
| Last Updated | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for nasa earthdata-search
Be the first to know when new medium vulnerabilities affecting nasa earthdata-search are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
NASA / earthdata-search
1.0.0
References
vuldb.com: https://vuldb.com/vuln/397223 vuldb.com: https://vuldb.com/vuln/397223/cti vuldb.com: https://vuldb.com/cve/CVE-2026-82802 vuldb.com: https://vuldb.com/submit/881828 github.com: https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Unauthenticated%20OpenSearch%20Granule%20SSRF
Credits
🔍 nmmorette (VulDB User) VulDB CNA Team