CVE-2026-16637 Overview
CVE-2026-16637 affects OPeNDAP Hyrax, a data server widely deployed for scientific and Earth-observation data distribution. The vulnerability enables Server-Side Request Forgery (SSRF) and credential disclosure through unvalidated HTTP redirects. Attackers craft requests that bypass the AllowedHosts allowlist by leveraging redirect chains. The server follows attacker-controlled redirects and forwards sensitive Earthdata authentication headers, including User-Id and Echo-Token, to hostile endpoints. This weakness is classified under [CWE-201: Insertion of Sensitive Information Into Sent Data]. The flaw exposes NASA Earthdata credentials and allows attackers to reach internal services otherwise protected by the allowlist control.
Critical Impact
Attackers can exfiltrate Earthdata authentication tokens and pivot to internal network resources by tricking Hyrax into following crafted redirects that bypass host validation.
Affected Products
- OPeNDAP Hyrax data server versions prior to 1.18
- Hyrax Docker deployments referencing vulnerable base images
- Deployments integrating Earthdata Login authentication
Discovery Timeline
- 2026-08-07 - CVE-2026-16637 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-16637
Vulnerability Analysis
OPeNDAP Hyrax implements an AllowedHosts allowlist to restrict outbound HTTP requests to trusted domains. The allowlist check occurs only against the initial request URL. When the destination server responds with an HTTP 3xx redirect, Hyrax follows the redirect without re-validating the new target against AllowedHosts. Attackers who control any resource on an allowlisted host, or who can influence a trusted upstream response, redirect Hyrax to arbitrary destinations.
During the redirected request, Hyrax retains and forwards authentication headers used for Earthdata Login integration. The User-Id and Echo-Token headers reach the attacker-controlled endpoint, exposing credentials that grant access to NASA data catalogs and user resources. The vulnerability also enables SSRF against internal services such as cloud metadata endpoints and private APIs unreachable from the public internet.
Root Cause
The root cause is missing revalidation of redirect targets against the configured allowlist. The HTTP client component treats redirect handling as a transport-layer concern rather than a security boundary. Sensitive headers propagate across redirect hops without scope enforcement, violating the principle of least privilege for credential exposure.
Attack Vector
An attacker crafts a Hyrax request referencing an allowlisted URL that returns a 302 redirect to an attacker-controlled host. Hyrax follows the redirect, forwards the Earthdata User-Id and Echo-Token headers, and returns response content to the caller. The attack requires user interaction, such as an authenticated user issuing the initial request, but requires no privileges on the Hyrax server itself. See the CERT Vulnerability Note #305509 for additional technical detail.
Detection Methods for CVE-2026-16637
Indicators of Compromise
- Outbound Hyrax connections to hosts not present in the configured AllowedHosts list
- HTTP requests from Hyrax containing Echo-Token or User-Id headers directed to unexpected external domains
- Redirect chains in Hyrax access logs terminating at non-NASA or non-Earthdata endpoints
- Anomalous access patterns against internal metadata services (for example, 169.254.169.254) originating from Hyrax hosts
Detection Strategies
- Parse Hyrax bes.log and access logs for 3xx responses followed by requests to hosts outside the allowlist
- Correlate egress firewall logs with the Hyrax AllowedHosts configuration to identify policy violations
- Deploy network monitoring rules that alert when Earthdata token headers appear in traffic to non-approved destinations
Monitoring Recommendations
- Enable DNS query logging on Hyrax hosts to identify lookups for attacker-controlled domains
- Monitor for unexpected outbound TLS connections from the Hyrax service account
- Alert on Earthdata token reuse from IP addresses that do not match legitimate Hyrax deployments
How to Mitigate CVE-2026-16637
Immediate Actions Required
- Upgrade to OPeNDAP Hyrax 1.18 or later, which addresses the redirect validation flaw
- Rotate all Earthdata Echo-Token credentials that may have transited vulnerable Hyrax instances
- Restrict Hyrax egress traffic at the network layer to known Earthdata and data provider endpoints
Patch Information
The official Hyrax 1.18 release corrects redirect handling and enforces the AllowedHosts allowlist on redirect targets. Container operators should rebuild deployments using the updated images from the Hyrax Docker repository. Review release notes to confirm configuration compatibility with local Earthdata integrations.
Workarounds
- Disable automatic redirect following in the Hyrax HTTP client configuration until patching completes
- Configure an egress proxy that enforces destination allowlisting independently of the Hyrax application
- Remove or scope Earthdata authentication headers to a per-request basis so credentials never propagate across redirects
# Configuration example: restrict Hyrax egress via iptables allowlist
iptables -A OUTPUT -m owner --uid-owner hyrax -d urs.earthdata.nasa.gov -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner hyrax -d cmr.earthdata.nasa.gov -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner hyrax -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
