Description
Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind validation. Attackers can submit loopback addresses, RFC 1918 ranges, or link-local addresses through the embedding endpoint API to partially read responses from cloud instance metadata services, internal APIs, and other hosts reachable from the server.
References (5)
Core 5
Core References
Exploit technical-description
exploit
Researcher Blog
https://aydinnyunus.github.io/2026/06/16/odysseus-embedding-endpoint-takeover/
Exploit technical-description
exploit
Researcher Disclosure
https://github.com/odysseus-dev/odysseus/issues/132
Patch patch
Patch Commit
https://github.com/odysseus-dev/odysseus/commit/87babb58d57897089b133b313e2ab6d09e7ef54e
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/odysseus-ssrf-via-embedding-endpoint-configuration
Scores
CVSS v3
6.8
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (1)
odysseus-dev/odysseus
< 87babb58d57897089b133b313e2ab6d09e7ef54e
Published
Aug 04, 2026
Tracked Since
Aug 05, 2026