Dashboard / CVE-2026-70620

CVE-2026-70620

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 57/100
Published: 2026-08-04 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: X
AT: None
VC: None
VI: None
VA: None

Description

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

Weakness Classification (1)

References & Advisories (5)

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.46%
Raw Score 0.004590
Percentile 39.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00459
2026-10-28
0.00459

Intelligence Sources

nvd ref →

External Links