CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search

Mon, 31 Aug 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82801%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20SSRF%20and%20Internal%20Host%20Discovery%20via%20Scale%20Image%20Endpoint
📋 CVE record: CVE-2026-82801

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/scaleImage/handler.js`, `scaleImage` (route `GET /scale`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82801

Vulnerability Summary

GET /scale?imageSrc=<URL> makes the server fetch any attacker-supplied URL, with no authentication and no validation of the URL. On its own this looks like a harmless blind SSRF, the response is always the same default image. It is not harmless. Because the endpoint runs inside NASA’s cloud environment, the same primitive lets an unauthenticated attacker use the server as a proxy into the internal network it sits in, and the response timing reveals which internal, otherwise-unreachable hosts are alive. An external attacker maps the internal network one request at a time.

CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint)

Mon, 31 Aug 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82802%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20Response-Reflecting%20SSRF%20in%20OpenSearch%20Granule%20Endpoint
📋 CVE record: CVE-2026-82802

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/openSearchGranuleSearch/handler.js`, `openSearchGranuleSearch` (route `POST /opensearch/granules`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82802

Vulnerability Summary

POST /opensearch/granules takes a caller-supplied openSearchOsdd URL, fetches it server-side, pulls a template URL out of the returned OpenSearch Description Document, fetches that too, and returns the raw second-hop response body to the caller. Both fetches are attacker-controlled, the route uses an optional authorizer so anonymous requests reach the handler, and neither fetch validates scheme, host, or IP. Because the raw body is reflected verbatim, an unauthenticated attacker does not just reach internal resources, it reads them: the endpoint is a full read primitive for any internal service that answers with text, HTML, or XML.

SSRF on Natan Maia Morette

CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search

Advisory Information

Vulnerability Summary

CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint)

Advisory Information

Vulnerability Summary