Skip to main content

CISA issues advisory on OPeNDAP Hyrax SSRF and credential disclosure

Source Decision Insights Threat Desk Published August 23, 2026 Companies 1
Human View Machine View

41st article in the last 90 days, one of 584 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on Plane multi-tenant authorization bypass (Aug 2026).

Companies mentioned

Best suited for

Seniority
EVP / SVP / VP / AVP
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Post Buy
Adoption curve
Early Majority
Technology maturity
Emerging Exploration
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

OPeNDAP Hyrax contains a server-side request forgery and credential disclosure issue that can let a remote attacker cause the application to communicate with unauthorized remote systems, including a condition where user authentication tokens may be disclosed to unintended destinations.

The issue is identified as CVE-2026-16637. It involves unvalidated HTTP redirects that bypass the AllowedHosts allowlist, described as being specified through a regular expression, and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints. OPeNDAP Hyrax follows HTTP 3xx redirects without checking whether the new destination remains on the allowed list, enabling redirection to an untrusted or internal target that would otherwise be blocked. When the software follows such a redirect, it may carry certain user identification headers, including a legacy credential called Echo-Token, to the new destination, while the main authorization token is correctly stripped by the underlying library.

Successful exploitation could allow an unauthenticated remote attacker to access internal services that are not intended to be reachable from the internet. If a user is authenticated when exploitation occurs, the attacker may also obtain the user’s Earthdata identifier and a reusable legacy credential. These credentials could be used to access protected datasets or other resources as the affected user.

CERT/CC is currently unaware of a practical solution to this problem. OPeNDAP has been notified and is working to develop a patch that will be released shortly, if it hasn’t already. Administrators of Hyrax servers are advised to review allowed host configurations carefully and consider limiting exposure of the gateway endpoint to trusted networks until the fix is available, likely in versions Hyrax-1.18.0 or later.

The guidance advises reviewing allowed host configurations and limiting exposure of the gateway endpoint to trusted networks until a fix is available, with the expectation that the fix will be in versions Hyrax-1.18.0 or later.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-advisory-on-opendap-hyrax-ssrf-and-credential-disclosure/",
        "name": "CISA issues advisory on OPeNDAP Hyrax SSRF and credential disclosure",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-opendap-hyrax-ssrf-and-credential-disclosure/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "EVP / SVP / VP / AVP"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Emerging Exploration"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:55:54-06:00",
    "datePublished": "2026-08-23T09:43:47-06:00",
    "description": "OPeNDAP Hyrax CVE-2026-16637 describes SSRF and credential disclosure via unvalidated HTTP redirects that bypass AllowedHosts and leak User-Id and Echo-Token.",
    "headline": "CISA issues advisory on OPeNDAP Hyrax SSRF and credential disclosure",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/305509"
    },
    "keywords": [
      "gateway"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-opendap-hyrax-ssrf-and-credential-disclosure/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages