CISA issues advisory on OPeNDAP Hyrax SSRF and credential disclosure

OPeNDAP Hyrax contains a server-side request forgery and credential disclosure issue that can let a remote attacker cause the application to communicate with unauthorized remote systems, including a condition where user authentication tokens may be disclosed to unintended destinations.

The issue is identified as CVE-2026-16637. It involves unvalidated HTTP redirects that bypass the AllowedHosts allowlist, described as being specified through a regular expression, and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints. OPeNDAP Hyrax follows HTTP 3xx redirects without checking whether the new destination remains on the allowed list, enabling redirection to an untrusted or internal target that would otherwise be blocked. When the software follows such a redirect, it may carry certain user identification headers, including a legacy credential called Echo-Token, to the new destination, while the main authorization token is correctly stripped by the underlying library.

Successful exploitation could allow an unauthenticated remote attacker to access internal services that are not intended to be reachable from the internet. If a user is authenticated when exploitation occurs, the attacker may also obtain the user’s Earthdata identifier and a reusable legacy credential. These credentials could be used to access protected datasets or other resources as the affected user.

CERT/CC is currently unaware of a practical solution to this problem. OPeNDAP has been notified and is working to develop a patch that will be released shortly, if it hasn’t already. Administrators of Hyrax servers are advised to review allowed host configurations carefully and consider limiting exposure of the gateway endpoint to trusted networks until the fix is available, likely in versions Hyrax-1.18.0 or later.

The guidance advises reviewing allowed host configurations and limiting exposure of the gateway endpoint to trusted networks until a fix is available, with the expectation that the fix will be in versions Hyrax-1.18.0 or later.

Source: kb.cert.org.