Thoropass on Natan Maia Morette

CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search

Mon, 31 Aug 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82801%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20SSRF%20and%20Internal%20Host%20Discovery%20via%20Scale%20Image%20Endpoint
📋 CVE record: CVE-2026-82801

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/scaleImage/handler.js`, `scaleImage` (route `GET /scale`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82801

Vulnerability Summary

GET /scale?imageSrc=<URL> makes the server fetch any attacker-supplied URL, with no authentication and no validation of the URL. On its own this looks like a harmless blind SSRF, the response is always the same default image. It is not harmless. Because the endpoint runs inside NASA’s cloud environment, the same primitive lets an unauthenticated attacker use the server as a proxy into the internal network it sits in, and the response timing reveals which internal, otherwise-unreachable hosts are alive. An external attacker maps the internal network one request at a time.

CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint)

Mon, 31 Aug 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82802%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20Response-Reflecting%20SSRF%20in%20OpenSearch%20Granule%20Endpoint
📋 CVE record: CVE-2026-82802

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/openSearchGranuleSearch/handler.js`, `openSearchGranuleSearch` (route `POST /opensearch/granules`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82802

Vulnerability Summary

POST /opensearch/granules takes a caller-supplied openSearchOsdd URL, fetches it server-side, pulls a template URL out of the returned OpenSearch Description Document, fetches that too, and returns the raw second-hop response body to the caller. Both fetches are attacker-controlled, the route uses an optional authorizer so anonymous requests reach the handler, and neither fetch validates scheme, host, or IP. Because the raw body is reflected verbatim, an unauthenticated attacker does not just reach internal resources, it reads them: the endpoint is a full read primitive for any internal service that answers with text, HTML, or XML.

CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint

Sun, 14 Jun 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-12188%20-%20grit42%20-%20SQL%20Injection%20in%20CSV%20Export%20Endpoint
📋 CVE record: CVE-2026-12188

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	grit - Open-source scientific research data management platform built by grit42 A/S. The platform stores and visualises data from pre-clinical drug discovery workflows: compounds, batches, assay models, experiment results, and dynamically-typed data tables.
Affected Version	0.0.x through 0.11.0 (every public release; sink introduced in initial commit `79b9dfa`)
Endpoint	`GET /api/grit/<engine>/<resource>/export` (any resource declared with `resources_with_export`)
Vulnerability Type	CWE-89: SQL Injection
CVE ID	CVE-2026-12188

Vulnerability Summary

The CSV export action in grit’s GritEntityController splats the user-controlled params[:columns] into Model.unscoped.select(*params[:columns]), then wraps the resulting relation in a PostgreSQL COPY (...) TO STDOUT WITH CSV HEADER statement. Rails’ select accepts raw SQL fragments, so any authenticated user can inject sub-selects into the SELECT clause and exfiltrate any column the database role can see.

CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter

Sun, 03 May 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7680%20-%20COCO%20Annotator%20-%20Path%20Traversal%20via%20Dataset%20Folder%20Parameter
📋 CVE record: CVE-2026-7680

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetDataId` endpoint
Vulnerability Type	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
CVE ID	CVE-2026-7680

Vulnerability Summary

A path traversal vulnerability exists in the COCO Annotator dataset browsing API. The GET /api/dataset/<id>/data endpoint accepts a folder query parameter that is concatenated into a filesystem path without proper sanitization or containment validation.

CVE-2026-7681: COCO Annotator — Unauthenticated Dataset Modification via Missing Authentication

Sun, 03 May 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7681%20-%20COCO%20Annotator%20-%20Unauthenticated%20Dataset%20Modification%20via%20Missing%20Authentication
📋 CVE record: CVE-2026-7681

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetId` resource, `POST` method
Vulnerability Type	CWE-306: Missing Authentication for Critical Function
CVE ID	CVE-2026-7681

Vulnerability Summary

A missing authentication vulnerability exists in the COCO Annotator dataset management API. The POST /api/dataset/<id> endpoint, which updates a dataset’s categories and default annotation metadata, is missing the @login_required decorator. This allows any unauthenticated, anonymous attacker to modify any dataset in the system with a single HTTP request — no credentials, no session cookie, and no token required.

CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2108%20-%20COCO%20Annotator%20-%20Unauthenticated%20Denial%20of%20Service%20via%20Task%20Queue%20Flood
📋 CVE record: CVE-2026-2108

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/info/long_task`
Vulnerability Type	CWE-306: Missing Authentication for Critical Function; CWE-400: Uncontrolled Resource Consumption
CVE ID	CVE-2026-2108

Vulnerability Summary

The endpoint /api/info/long_task is exposed without authentication or rate limiting, and allows any remote user to enqueue Celery background tasks and write entries to the database (TaskModel) on every request.

CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2109%20-%20COCO%20Annotator%20-%20Broken%20Function%20Level%20Authorization%20in%20Undo%20Endpoint
📋 CVE record: CVE-2026-2109

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/undo/`
Vulnerability Type	CWE-285: Improper Authorization (Broken Function Level Authorization)
CVE ID	CVE-2026-2109

Vulnerability Summary

An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources.

CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload

Fri, 06 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2064%20-%20i-Educar%20-%20Stored%20XSS%20via%20Profile%20Picture%20Upload
📋 CVE record: CVE-2026-2064

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	i-Educar - Open-source, web-based school management system widely used by public education institutions in Brazil to manage academic and administrative data in real time.
Affected Version	2.10.0
Endpoint	`/intranet/meusdadod.php`
Vulnerability Type	CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)
CVE ID	CVE-2026-2064

Vulnerability Summary

The /intranet/meusdadod.php endpoint allows authenticated users to upload profile pictures (avatars) without proper file type validation or content sanitization. By exploiting the lack of server-side MIME type verification and file content inspection, an attacker can upload a malicious SVG file containing embedded JavaScript code disguised as a legitimate image file.