CVE-2026-82801: NASA earthdata-search SSRF Vulnerability

CVE-2026-82801 Overview

CVE-2026-82801 is a Server-Side Request Forgery (SSRF) vulnerability in NASA earthdata-search 1.0.0. The flaw resides in the scaleImage function within serverless/src/scaleImage/handler.js, part of the scale Endpoint component. An unauthenticated remote attacker can manipulate input to the endpoint and coerce the server into issuing arbitrary outbound HTTP requests. The exploit has been made public, increasing the likelihood of opportunistic use. The vendor was contacted before public disclosure but did not respond. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can abuse the scale image endpoint to reach internal services, cloud metadata endpoints, and other network resources reachable from the serverless function.

Affected Products

NASA earthdata-search 1.0.0
Component: scale Endpoint (serverless/src/scaleImage/handler.js)
Function: scaleImage

Discovery Timeline

2026-08-31 - CVE-2026-82801 published to NVD
2026-09-01 - Last updated in NVD database
2026-09-03 - EPSS score published

Technical Details for CVE-2026-82801

Vulnerability Analysis

The scaleImage handler accepts a user-supplied image reference and fetches it server-side before returning a resized asset. Because the handler does not validate or restrict the destination of the outbound request, an attacker can supply arbitrary URLs. The server then issues requests on the attacker's behalf from its own trust context.

In a serverless deployment, this trust context often includes access to cloud provider metadata services, internal load balancers, and private VPC resources. Attackers can enumerate internal infrastructure, retrieve short-lived cloud credentials from instance metadata endpoints, and pivot to non-public APIs. The vulnerability is exploitable over the network with no authentication and no user interaction.

Root Cause

The root cause is missing validation of the destination host and scheme in the scaleImage function. The handler treats caller-supplied URLs as trusted and forwards them to an HTTP client without allowlisting permitted domains, blocking private IP ranges, or filtering redirect chains. This is a textbook instance of [CWE-918].

Attack Vector

Exploitation requires only network access to the exposed scale image endpoint. An attacker sends a crafted request that references an internal IP address, localhost, or a cloud metadata URL such as 169.254.169.254. The handler fetches the target and either returns response content, leaks response metadata via timing and error differences, or triggers side effects on internal services. See the public research writeup for exploitation details.

No verified proof-of-concept code is reproduced here. Technical details are available in the VulDB entry for CVE-2026-82801.

Detection Methods for CVE-2026-82801

Indicators of Compromise

Outbound HTTP requests from the earthdata-search serverless function to private IP ranges (RFC1918), link-local addresses, or 169.254.169.254.
Unexpected scaleImage invocations containing non-image URLs, unusual schemes (file://, gopher://), or DNS names resolving to internal hosts.
Cloud audit log entries showing metadata service access from the function's execution role.
Repeated failed image scaling operations correlated with reconnaissance patterns.

Detection Strategies

Instrument the scaleImage handler with request logging that records the resolved destination host, IP, and response size.
Deploy egress filtering on the serverless environment and alert on any denied connection attempts.
Correlate application logs with VPC flow logs to identify anomalous outbound destinations from the function.

Monitoring Recommendations

Monitor cloud provider metadata endpoint access from all serverless functions and alert on any hits.
Track short-lived credential usage from the function's IAM role for anomalous API calls or geolocations.
Alert on scaleImage invocation rates exceeding baseline, which may indicate automated exploitation.

How to Mitigate CVE-2026-82801

Immediate Actions Required

Restrict public exposure of the scale image endpoint using authentication, WAF rules, or network ACLs until a fix is deployed.
Apply strict egress controls to the serverless function, blocking access to RFC1918, link-local, and metadata IP ranges.
Scope the function's IAM role to least privilege and rotate any credentials that may have been exposed.
Review logs for prior exploitation attempts against serverless/src/scaleImage/handler.js.

Patch Information

No vendor patch is available at the time of publication. The NASA earthdata-search maintainers did not respond to the disclosure. Organizations running earthdata-search 1.0.0 should apply source-level mitigations by modifying scaleImage to allowlist permitted image hosts, reject non-HTTP(S) schemes, and resolve DNS names before validating that the resulting IP is public. Track the VulDB advisory for updates.

Workarounds

Implement a URL allowlist in scaleImage that only permits known NASA and CDN image hosts.
Resolve destination hostnames server-side and reject requests targeting private, loopback, or link-local addresses.
Force IMDSv2 on EC2-backed workloads and require session tokens for metadata access.
Place the scale endpoint behind an authenticated API gateway with per-caller rate limits.

bash

# Example egress restriction using an AWS security group (conceptual)
# Block metadata and private ranges from the function's ENI
aws ec2 authorize-security-group-egress \
  --group-id sg-xxxxxxxx \
  --ip-permissions 'IpProtocol=-1,IpRanges=[{CidrIp=169.254.169.254/32,Description="deny-imds"}]' \
  --dry-run