CVE-2026-70620

Medium

Description

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.

SeverityMedium

CVSS6.8

Exploit probability—

ProductOdysseus

PublishedAug 4, 2026

First seenAug 4, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

odysseus-dev odysseus87babb58d57897089b133b313e2ab6d09e7ef54e or later

Patches

github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e

Affected products

Product	Affected versions	Fixed in
odysseus-dev odysseus	v < 87babb58d57897089b133b313e2ab6d09e7ef54e	87babb58d57897089b133b313e2ab6d09e7ef54e

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.