CVE-2026-16637: OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
Published Aug 7, 2026
·Updated
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.
Affected Software
1 affected component
OPeNDAP Hyrax
Event History
Aug 7, 2026
CVE Published
via MITRE·01:14 PM
Data Sourced
via MITRE·01:14 PM
DescriptionWeakness
Data Sourced
via NVD·02:16 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-16637?
CVE-2026-16637 has a risk score of 65, indicating a moderate level of severity.
2
How do I fix CVE-2026-16637?
To mitigate CVE-2026-16637, validate all redirects and ensure that the AllowedHosts allowlist is correctly configured.
3
What does CVE-2026-16637 affect?
CVE-2026-16637 affects the OPeNDAP Hyrax software, specifically concerning SSRF and credential disclosure.
4
What are the potential impacts of CVE-2026-16637?
The potential impacts of CVE-2026-16637 include unauthorized access to sensitive Earthdata headers such as User-Id and Echo-Token.
5
When was CVE-2026-16637 published?
CVE-2026-16637 was published on August 7, 2026.