CVE-2026-82802: NASA earthdata-search SSRF Vulnerability

CVE-2026-82802 Overview

CVE-2026-82802 is a Server-Side Request Forgery (SSRF) vulnerability in NASA earthdata-search 1.0.0. The flaw resides in the OpenSearchGranuleSearchLambda function inside serverless/src/openSearchGranuleSearch/handler.js, which handles requests to the granules endpoint. Attackers can manipulate the openSearchOsdd argument to force the server to issue arbitrary outbound HTTP requests. The attack is unauthenticated and remotely exploitable. A public exploit has been published, and the vendor did not respond to disclosure attempts [CWE-918].

Critical Impact
Unauthenticated remote attackers can coerce the earthdata-search backend into making arbitrary outbound requests, potentially reaching internal services, cloud metadata endpoints, or otherwise trusted infrastructure.

Affected Products

NASA earthdata-search 1.0.0
Component: granules Endpoint
File: serverless/src/openSearchGranuleSearch/handler.js

Discovery Timeline

2026-08-31 - CVE-2026-82802 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82802

Vulnerability Analysis

The vulnerability affects the serverless granules search Lambda handler in NASA earthdata-search 1.0.0. The OpenSearchGranuleSearchLambda function accepts a client-supplied openSearchOsdd parameter that identifies an OpenSearch Description Document URL. The handler dereferences that URL server-side without sufficient allowlisting or validation of the target host. An attacker who controls the openSearchOsdd argument can direct the Lambda to fetch resources of the attacker's choosing.

Because the endpoint is reachable without authentication, exploitation requires only crafted network traffic to the granules endpoint. The vendor was contacted about this disclosure but did not respond, and a public exploit has been released.

Root Cause

The root cause is missing validation of a user-controlled URL parameter before it is used to issue an outbound HTTP request. The handler treats openSearchOsdd as a trusted input rather than enforcing a strict allowlist of NASA data provider endpoints. This aligns with CWE-918: Server-Side Request Forgery.

Attack Vector

An unauthenticated attacker sends a request to the granules endpoint with a crafted openSearchOsdd argument pointing to an internal or attacker-controlled URL. The Lambda executes the request from its own execution environment, which typically has network paths and IAM context unavailable to external clients. Depending on deployment, this can be leveraged to probe internal services, retrieve cloud provider metadata, or interact with adjacent AWS resources.

See the published research at the GitHub SSRF Vulnerability Research repository for exploitation specifics, and the VulDB entry for CVE-2026-82802 for additional threat intelligence.

Detection Methods for CVE-2026-82802

Indicators of Compromise

Requests to the granules endpoint containing an openSearchOsdd parameter whose value does not match expected NASA data provider hostnames.
Outbound connections from the earthdata-search Lambda to internal RFC1918 ranges, 169.254.169.254, or unexpected external hosts.
Cloud audit log entries showing Lambda-originated calls to the instance metadata service or unrelated AWS APIs.

Detection Strategies

Inspect API Gateway and Lambda invocation logs for anomalous openSearchOsdd values, particularly those containing IP literals, non-HTTPS schemes, or non-approved domains.
Baseline the set of outbound destinations the granules Lambda contacts and alert on deviations.
Correlate spikes in granules endpoint traffic with new outbound egress destinations from the associated VPC or NAT gateway.

Monitoring Recommendations

Enable VPC Flow Logs and CloudWatch metrics on the Lambda's execution role and network interfaces.
Forward serverless logs into a SIEM or data lake and alert on URL parameters that fail an allowlist check.
Monitor for authentication attempts or errors from the cloud metadata endpoint originating from the Lambda's role.

How to Mitigate CVE-2026-82802

Immediate Actions Required

Restrict public exposure of the granules endpoint until validation is in place; require authentication where feasible.
Deploy an egress allowlist so the earthdata-search Lambda can only reach approved NASA OpenSearch data providers.
Block the Lambda's execution role from reaching the instance metadata service by enforcing IMDSv2 and network policy.
Review recent invocation logs for exploitation attempts using the openSearchOsdd parameter.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Operators of forks or self-hosted deployments should implement input validation in serverless/src/openSearchGranuleSearch/handler.js to enforce a strict allowlist of permitted openSearchOsdd hosts and reject non-HTTPS or private-address targets. Track updates via the VulDB vulnerability record #397223.

Workarounds

Add a reverse proxy or WAF rule that rejects requests where openSearchOsdd does not match an approved list of NASA data provider domains.
Place the Lambda in a private subnet with egress routed through a proxy that enforces destination filtering.
Scope the Lambda's IAM role to the minimum permissions required, removing access to metadata-derived credentials and unrelated AWS services.

bash

# Example: enforce allowlist at the edge (nginx snippet)
location /granules {
    if ($arg_openSearchOsdd !~* "^https://[a-z0-9.-]+\.(nasa|earthdata)\.gov/") {
        return 400;
    }
    proxy_pass https://backend;
}