CVE-2026-82802: NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker control to exploit this issue?
The attacker needs to manipulate the openSearchOsdd argument processed by OpenSearchGranuleSearchLambda in the granules endpoint. The attack can be launched remotely and requires no privileges or user interaction according to the supplied severity vector.
What is the likely security impact?
Successful exploitation can cause server-side requests to attacker-chosen locations. The supplied assessment indicates low confidentiality impact, with no stated integrity or availability impact.
Is public exploit code available?
Yes. The supplied data states that an exploit has been published and may be used.
Which version is identified as affected?
The supplied information identifies NASA earthdata-search version 1.0.0 as affected. No fixed version or mitigation is provided.